Documentation: docs/, a changelog, and CLAUDE.md

PROGRESS.md becomes CHANGELOG.md with the finished step lists moved to an
appendix. The README is an overview pointing at docs/: configuration,
cli, users, sso (refreshed for accounts and admin-only settings), and
architecture. CLAUDE.md collects what working on this code actually
requires -- pkill -x not -f, the page being compiled in, the dead columns
on entries, the Playwright worker that deleted its own database.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

docs/sso.md

@@ -35,7 +35,15 @@ Restart the daemon after editing. Accounts made this way have **no password**: t
 arrive through the proxy. `ipx user list` marks them `proxy only`.
 
 The first account created is an admin. Every later one is an ordinary user, and an ordinary user
-cannot change global settings or how often feeds are scanned. Promote someone with:
+cannot change global settings, a feed's URL or folder, or how often feeds are scanned: the API
+refuses those with a `403`, not just the UI. Everything else about a feed (which items they want,
+whether to fetch them, how many at a time) is theirs alone; see [users.md](users.md).
+
+Somebody arriving through the proxy for the first time starts with **no feeds**, because
+subscriptions are per person. Adding a feed someone else already reads costs no second fetch and no
+second copy on disk.
+
+Promote someone with:
 
 ```sh
 ipx user list
@@ -43,7 +51,9 @@ echo -n 'a good password' | ipx user passwd <name>   # optional: also lets them
 ```
 
 Local sign-in at `/login` keeps working alongside all of this, which is how you get in from the LAN
-when the tunnel is down. A brand new database starts with **admin / ipodderx** — change it.
+when the tunnel is down. So does the shared `[web] token`, which signs in as the admin: that is
+what the Docker healthcheck uses, and the way back in if you lock yourself out. A brand new database
+starts with **admin / ipodderx** — change it.
 
 ---
 
@@ -206,7 +216,13 @@ ipx user rm sam                                # remove the account
 
 Set `auto_create_users = false` once everyone who should have an account has one. After that the
 proxy vouching for an unknown name is logged and refused, rather than quietly making an account.
+Pre-create people instead with `ipx user add <name> --no-password`, using exactly the name the
+header will carry (Cloudflare sends the email address, lower-cased).
 
-Scanning intervals, the disk quota, retention and the download folder are **admin-only** — the
-Settings button is hidden for everyone else, and the API refuses the change even if the request is
-made by hand. Ordinary users still control their own folders, keywords and downloads per feed.
+Scanning intervals, the disk quota, retention, the download folder and a feed's URL are
+**admin-only**: the Settings button is hidden for everyone else, and the API refuses the change even
+if the request is made by hand. Everyone controls their own keywords, auto-download, explicit
+setting and per-scan cap, along with their own read state and which feeds they see.
+
+See also [users.md](users.md) for what several people share, [configuration.md](configuration.md)
+for every `[web]` key, and [cli.md](cli.md) for the `ipx user` commands.