Release 0.5.3: OPML orphan scan, feed error UI, small UI fixes

- Stop scanning an OPML/Patreon feed's derived rows once nobody subscribes
  to it; retire them (drop or orphan) the way sync_group already does when
  the list itself drops one. This is what let 922 defunct davewiner feeds
  keep scanning hourly after the OPML left config.
- Repair feed XML with a bare `&`, and give a plain reason (moved web page
  with its new address when linked, or nothing yet for an empty body)
  instead of a raw parser error.
- Show a failing feed's plain-English reason and next step (Unsubscribe /
  Use the new address) in the sidebar and on its own page, once it has
  been down a day.
- Fix four small UI bugs: show-note links open in a new tab, video files
  play as video, an opened item no longer disappears from the Unread tab,
  and Subscribe/Unsubscribe get their own icons.
- Fix Settings disappearing for non-admin accounts: it was hiding the
  whole modal instead of just the admin-only parts (Users, the editable
  schedule/quota, Save), which are the only parts the server actually
  refuses them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DmQfE1eFPApnXWyPHBWqUA

tests/ui/app.spec.js

@@ -359,7 +359,15 @@ test('a second person has their own feeds and their own read state', async ({ br
 
   // Sam subscribes to nothing yet, so sees nothing -- the admin's feeds are not theirs.
   await expect(page.locator('#feedlist')).toContainText('No feeds.');
-  await expect(page.locator('#prefs')).toBeHidden();      // not an admin
+  // Settings stays: Sam has their own subscriptions to export and import, and the
+  // schedule and quota are worth seeing even without a say in them. Only the log and the
+  // users screen -- and the server -- are an admin's alone.
+  await expect(page.locator('#prefs')).toBeVisible();
+  await page.locator('#prefs').click();
+  await expect(page.locator('#modalCard')).toContainText('Subscriptions');
+  await expect(page.locator('#gsave')).toBeHidden();
+  await expect(page.locator('#gusers')).toBeHidden();
+  await page.locator('#modalCard .cardacts .btn').first().click();
   // Hiding the button is not the guard; the server is.
   expect((await page.request.get('/api/users')).status()).toBe(403);
   await expect(page.locator('#logs')).toBeHidden();
@@ -790,7 +798,9 @@ test('play in the Files pane plays once, in the player bar', async ({ page }) =>
   await page.locator('.ep', { has: page.locator('.kind.here') }).first().click();
   await page.locator('#files [data-a="play"]').click();
   await expect(page.locator('#player')).toBeVisible();
-  await expect(page.locator('audio')).toHaveCount(1);   // the player bar's, and nothing else
+  // The player bar's element doubles as a <video> so a video file has somewhere to show its
+  // picture (see #audio's own comment), but there is still exactly one of it, and nothing else.
+  await expect(page.locator('#audio')).toHaveCount(1);
   await page.locator('#pclose').click();
 });