Release 0.5.3: OPML orphan scan, feed error UI, small UI fixes

- Stop scanning an OPML/Patreon feed's derived rows once nobody subscribes
  to it; retire them (drop or orphan) the way sync_group already does when
  the list itself drops one. This is what let 922 defunct davewiner feeds
  keep scanning hourly after the OPML left config.
- Repair feed XML with a bare `&`, and give a plain reason (moved web page
  with its new address when linked, or nothing yet for an empty body)
  instead of a raw parser error.
- Show a failing feed's plain-English reason and next step (Unsubscribe /
  Use the new address) in the sidebar and on its own page, once it has
  been down a day.
- Fix four small UI bugs: show-note links open in a new tab, video files
  play as video, an opened item no longer disappears from the Unread tab,
  and Subscribe/Unsubscribe get their own icons.
- Fix Settings disappearing for non-admin accounts: it was hiding the
  whole modal instead of just the admin-only parts (Users, the editable
  schedule/quota, Save), which are the only parts the server actually
  refuses them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DmQfE1eFPApnXWyPHBWqUA

docs/history.md

@@ -6,6 +6,28 @@ reasoning lives. New write-ups go at the top.
 
 See [README.md](../README.md) for what the thing is.
 
+## 2026-09-14 — Settings, for everyone with an account
+
+A user reported that Settings disappeared shortly after they signed in: it showed for a moment,
+then was gone. `#prefs` sat inside the same `.tgroup` as `#logs`, and `api('/api/me')` hid the
+whole group -- `$('#admintools').hidden=true` -- the moment it learned the account was not an
+admin. Nothing wrong with that check timing; it was hiding the wrong thing.
+
+The Settings modal is not actually all-or-nothing. `GET /api/settings`, and Export and Import
+OPML, carry no admin check server-side -- `export_opml` and `import_opml` work from a user's own
+subscriptions, and the schedule/quota page is read-only information, not a control. Only the
+`PATCH` that changes those settings, and the Users screen behind it, return 403 for anyone but an
+admin. The comment above the old hide -- "scanning, quotas, accounts and the log are the
+operator's business" -- was wrong about quotas and half wrong about accounts: reading them is
+everyone's; changing them is the operator's.
+
+`prefsModal()` now branches on `S.me.admin` the way the per-feed settings modal already does for
+its URL field: a non-admin gets the schedule and quota as text, Subscriptions (Export/Import)
+in full, and no Users section or Save button. Only `#logs` stays hidden, since the log names every
+account and every failed sign-in. The browser test for a second account asserted the old
+behaviour outright (`#prefs` hidden, not an admin) rather than what the server actually allows;
+fixing the UI meant fixing the test's premise too, not just the assertion.
+
 ## 2026-09-12 — Healthy while busy
 
 After a deploy the container sat at "starting" for a minute, and Docker's health log showed two