User admin in the web UI, admin-only log, unread-first OPML feeds

- Settings > Manage users: add an account (password, or none for proxy
  sign-in), toggle admin, remove. Backed by GET/POST /api/users and
  PATCH/DELETE /api/users/{id}, 403 for non-admins. The only admin
  cannot be demoted or removed.
- GET /api/logs is admin-only and the Log button is hidden for others;
  the log names every account, feed and failed sign-in.
- Feeds inside an OPML list those with unread items first, in the
  sidebar folder and on the subscription's page.
- Deploying is now buildx --push to 192.168.1.130:5000 and recreating
  the ipodderx service of the Arcane project content; CLAUDE.md and the
  README's Docker section say so.
- Tests: Playwright for user admin, the last-admin guard, 403s for a
  non-admin and the unread ordering (new Aardvark Radio fixture); a unit
  test for last_admin; the smoke test drives usersModal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173mGu6rK18Ne7UGTwAaVJV

src/web.rs

@@ -74,6 +74,8 @@ pub fn router(state: WebState) -> Router {
         .route("/api/fetch", post(fetch_now))
         .route("/api/opml", get(export_opml).post(import_opml))
         .route("/api/settings", get(get_settings).patch(patch_settings))
+        .route("/api/users", get(list_users).post(add_user))
+        .route("/api/users/{id}", patch(patch_user).delete(remove_user))
         .route("/api/logs", get(logs))
         .route("/api/events", get(events))
         .route("/media/{id}", get(media))
@@ -303,6 +305,125 @@ async fn me(user: crate::db::User) -> Json<serde_json::Value> {
     Json(serde_json::json!({ "name": user.name, "admin": user.is_admin }))
 }
 
+// ---- accounts: admin only ----
+
+fn require_admin(user: &crate::db::User) -> Result<(), ApiError> {
+    if user.is_admin {
+        Ok(())
+    } else {
+        Err(ApiError::forbidden("only an admin manages accounts"))
+    }
+}
+
+/// Demoting or removing this account would leave nobody able to manage anyone, and the only
+/// way back would be `ipx user` on the box.
+fn last_admin(users: &[crate::db::User], id: i64) -> bool {
+    let admins: Vec<i64> = users.iter().filter(|u| u.is_admin).map(|u| u.id).collect();
+    admins == [id]
+}
+
+async fn list_users(
+    State(state): State<WebState>,
+    user: crate::db::User,
+) -> Result<Json<serde_json::Value>, ApiError> {
+    require_admin(&user)?;
+    let users: Vec<_> = state
+        .ctx
+        .db
+        .users()?
+        .iter()
+        .map(|u| {
+            serde_json::json!({
+                "id": u.id, "name": u.name, "admin": u.is_admin, "password": u.pass_hash.is_some(),
+            })
+        })
+        .collect();
+    Ok(Json(serde_json::json!(users)))
+}
+
+#[derive(Deserialize)]
+struct NewUser {
+    name: String,
+    #[serde(default)]
+    password: String,
+    #[serde(default)]
+    admin: bool,
+}
+
+async fn add_user(
+    State(state): State<WebState>,
+    user: crate::db::User,
+    Json(body): Json<NewUser>,
+) -> Result<StatusCode, ApiError> {
+    require_admin(&user)?;
+    // The same rules as a name a proxy vouches for, so either way of signing in finds it.
+    let name = crate::auth::name_from_header(&body.name).ok_or_else(|| {
+        ApiError::bad_request("a name is required, without commas, semicolons or line breaks")
+    })?;
+    if state.ctx.db.user_by_name(&name)?.is_some() {
+        return Err(ApiError::bad_request(format!("{name} already exists")));
+    }
+    // No password is someone the proxy signs in, as with `ipx user add --no-password`.
+    let hash = if body.password.is_empty() {
+        None
+    } else {
+        Some(crate::auth::hash_password(&body.password).map_err(|e| ApiError::bad_request(format!("{e:#}")))?)
+    };
+    state.ctx.db.create_user(&name, hash.as_deref(), body.admin)?;
+    tracing::info!(by = %user.name, user = %name, admin = body.admin, "account added");
+    Ok(StatusCode::CREATED)
+}
+
+#[derive(Deserialize)]
+struct UserPatch {
+    admin: bool,
+}
+
+async fn patch_user(
+    State(state): State<WebState>,
+    user: crate::db::User,
+    Path(id): Path<i64>,
+    Json(body): Json<UserPatch>,
+) -> Result<StatusCode, ApiError> {
+    require_admin(&user)?;
+    let users = state.ctx.db.users()?;
+    let target = users
+        .iter()
+        .find(|u| u.id == id)
+        .ok_or_else(|| ApiError::bad_request(format!("no account with id {id}")))?;
+    if !body.admin && last_admin(&users, id) {
+        return Err(ApiError::bad_request(format!(
+            "{} is the only admin; make someone else an admin first",
+            target.name
+        )));
+    }
+    state.ctx.db.set_admin(id, body.admin)?;
+    tracing::info!(by = %user.name, user = %target.name, admin = body.admin, "admin changed");
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn remove_user(
+    State(state): State<WebState>,
+    user: crate::db::User,
+    Path(id): Path<i64>,
+) -> Result<StatusCode, ApiError> {
+    require_admin(&user)?;
+    let users = state.ctx.db.users()?;
+    let target = users
+        .iter()
+        .find(|u| u.id == id)
+        .ok_or_else(|| ApiError::bad_request(format!("no account with id {id}")))?;
+    if last_admin(&users, id) {
+        return Err(ApiError::bad_request(format!(
+            "{} is the only admin; make someone else an admin first",
+            target.name
+        )));
+    }
+    state.ctx.db.delete_user(id)?;
+    tracing::info!(by = %user.name, user = %target.name, "account removed");
+    Ok(StatusCode::NO_CONTENT)
+}
+
 async fn login_page() -> Html<&'static str> {
     Html(include_str!("../web/login.html"))
 }
@@ -473,6 +594,14 @@ impl IntoResponse for ApiError {
 mod tests {
     use super::*;
 
+    #[test]
+    fn only_the_last_admin_is_protected() {
+        let u = |id, is_admin| crate::db::User { id, name: format!("u{id}"), pass_hash: None, is_admin };
+        assert!(last_admin(&[u(1, true), u(2, false)], 1));
+        assert!(!last_admin(&[u(1, true), u(2, true)], 1), "another admin remains");
+        assert!(!last_admin(&[u(1, true), u(2, false)], 2), "not an admin at all");
+    }
+
     #[test]
     fn token_comparison_rejects_mismatches_and_length_differences() {
         assert!(constant_time_eq("abc123", "abc123"));
@@ -1161,9 +1290,13 @@ struct LogPage {
     latest: u64,
 }
 
-async fn logs(Query(q): Query<LogQuery>) -> Json<LogPage> {
+async fn logs(user: crate::db::User, Query(q): Query<LogQuery>) -> Result<Json<LogPage>, ApiError> {
+    // The log names every account, every feed and every failed sign-in, not just yours.
+    if !user.is_admin {
+        return Err(ApiError::forbidden("only an admin reads the log"));
+    }
     let (lines, latest) = crate::logbuf::since(q.after, q.limit.clamp(1, 2000));
-    Json(LogPage { lines, latest })
+    Ok(Json(LogPage { lines, latest }))
 }
 
 /// One line per HTTP request, so the web side shows up in the same log as the daemon.