User admin in the web UI, admin-only log, unread-first OPML feeds

- Settings > Manage users: add an account (password, or none for proxy
  sign-in), toggle admin, remove. Backed by GET/POST /api/users and
  PATCH/DELETE /api/users/{id}, 403 for non-admins. The only admin
  cannot be demoted or removed.
- GET /api/logs is admin-only and the Log button is hidden for others;
  the log names every account, feed and failed sign-in.
- Feeds inside an OPML list those with unread items first, in the
  sidebar folder and on the subscription's page.
- Deploying is now buildx --push to 192.168.1.130:5000 and recreating
  the ipodderx service of the Arcane project content; CLAUDE.md and the
  README's Docker section say so.
- Tests: Playwright for user admin, the last-admin guard, 403s for a
  non-admin and the unread ordering (new Aardvark Radio fixture); a unit
  test for last_admin; the smoke test drives usersModal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173mGu6rK18Ne7UGTwAaVJV

README.md

@@ -85,11 +85,15 @@ never left behind with nothing explaining where it came from.
 ## Docker
 
 ```sh
-docker compose up -d          # builds the image and starts it
-docker compose logs -f ipx    # the token is printed on first start
+docker buildx build --tag 192.168.1.130:5000/ipodderx:latest . --push
+docker compose pull ipodderx && docker compose up -d ipodderx
+docker compose logs -f ipodderx   # the first start prints the default admin password
 ```
 
-`docker-compose.yml` mounts `./config`, `./data` and a downloads directory, publishes 8099 for the
+`docker-compose.yml` runs the image from the registry above rather than building it, so build and
+push first; change the tag in both places to use another registry. It mounts `/config` (config.toml),
+`/data` (state.db) and `/downloads` from this install's host paths, which you will want to change for
+yours. It publishes 8099 for the
 UI and 6881 (TCP **and** UDP -- DHT needs the UDP side), and sets `PUID`/`PGID` to `99:100` so files
 land owned the way Unraid shares expect. The healthcheck runs `ipx status` through the control
 socket, so it catches a daemon that is alive but wedged rather than merely one that has died.