OPML import subscribes you; export lists only your feeds

Import predated accounts: it only added URLs missing from config.toml
and subscribed nobody. Importing another account's export did nothing
("Imported 0 feed(s)"), and a genuinely new feed had no subscriber, so
it was never scanned. Web and CLI import now share subscribe_opml,
which subscribes the caller (the CLI: the first admin) to every feed in
the file and reports new vs already-subscribed.

Export wrote the whole catalogue to anyone signed in, including other
people's private feed URLs. It now lists only your own subscriptions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0173mGu6rK18Ne7UGTwAaVJV

CHANGELOG.md

@@ -5,6 +5,20 @@ matters, what was wrong before -- the reasoning is the point, not the diff.
 
 See [README.md](README.md) for what the thing is, and [docs/](docs/) for how to run it.
 
+## 2026-09-11 — OPML import and export are per person
+
+Importing an OPML now subscribes you to every feed in it. Feeds already in the catalogue cost
+nothing, and unknown ones are added under the OPML's title. Before this, import only added URLs
+missing from `config.toml` and subscribed nobody. So importing an export from another account did
+nothing at all, and a genuinely new feed had no subscriber and was never scanned. The page said
+"Imported 0 feed(s)". `ipx import` had the same gap; it now subscribes the first admin. Both go
+through `subscribe_opml`.
+
+Export now lists only your own subscriptions. It used to write out the whole catalogue to anyone
+signed in, including other people's feeds and any private URLs in them.
+
+---
+
 ## 2026-09-11 — The log is admin-only
 
 `GET /api/logs` now returns `403` to anyone who is not an admin, and the page hides the Log button