User admin in the web UI, admin-only log, unread-first OPML feeds

- Settings > Manage users: add an account (password, or none for proxy
  sign-in), toggle admin, remove. Backed by GET/POST /api/users and
  PATCH/DELETE /api/users/{id}, 403 for non-admins. The only admin
  cannot be demoted or removed.
- GET /api/logs is admin-only and the Log button is hidden for others;
  the log names every account, feed and failed sign-in.
- Feeds inside an OPML list those with unread items first, in the
  sidebar folder and on the subscription's page.
- Deploying is now buildx --push to 192.168.1.130:5000 and recreating
  the ipodderx service of the Arcane project content; CLAUDE.md and the
  README's Docker section say so.
- Tests: Playwright for user admin, the last-admin guard, 403s for a
  non-admin and the unread ordering (new Aardvark Radio fixture); a unit
  test for last_admin; the smoke test drives usersModal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173mGu6rK18Ne7UGTwAaVJV

docs/users.md

@@ -70,13 +70,17 @@ list with their own read state. Unsubscribing removes it from their list alone;
 subscriber leaves does the feed stop being scanned, and even then its files and history stay, so
 re-subscribing does not pull the back catalogue again.
 
-Accounts are managed from the command line only; there is no user administration in the web UI yet.
+An admin can do the same from **Settings → Manage users…**: add someone (with a password, or none
+for someone the proxy signs in), tick or untick Admin, or remove an account. Removing one takes its
+subscriptions and read state with it; downloaded files stay. The only admin cannot be demoted or
+removed there, so there is always someone who can manage the rest.
 
 ## Admin
 
 The first account is an admin. An admin can change global settings (scanning interval, quota,
-retention, media types, download folder) and a feed's URL, folder and schedule. Everyone else gets
-the Settings button hidden and a `403` if they ask anyway.
+retention, media types, download folder), a feed's URL, folder and schedule, and who has an account
+and who else is an admin, and read the log, which names everyone's feeds and sign-ins. Everyone else
+gets the Settings and Log buttons hidden and a `403` if they ask anyway.
 
 ```sh
 ipx user list      # the admin column says who