Subscribe to an OPML, not just import one

A feed whose body sniffs as OPML is treated as a subscription list and
re-read on every scan, as iPodderX did. Listed feeds become real config
entries grouped under it, inherit its settings, land in one nested folder,
and are scanned in the same run.

When a feed leaves the OPML: removed if nothing was downloaded, kept and
flagged otherwise, so a downloaded file is never orphaned.

folder_for sanitized the whole folder string and would have flattened the
nesting; each segment is sanitized separately now, and a traversal still
cannot escape the download directory. Db::memory() also runs migrate(),
which it did not, so a migration-only column passed tests while missing in
production.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

README.md

@@ -101,6 +101,28 @@ Events: `feed_start`, `feed_skip`, `feed_done`, `feed_error`, `progress`, `downl
 Progress is throttled to whole percents. The stream is a broadcast, so a client attached to a busy
 daemon also sees that daemon's other work.
 
+## OPML
+
+Two different things, both supported:
+
+**Importing and exporting** a file copies subscriptions in or out once — `ipx import subs.opml`,
+`ipx export subs.opml`, or the OPML button in the UI.
+
+**Subscribing to an OPML URL** is a live subscription, as iPodderX had. Add the OPML's URL like any
+other feed; every scan re-reads it and keeps your feed list in step. Feeds it lists are added under
+that subscription (`group = "<opml-id>"` in the config, grouped in the sidebar) and downloaded into
+one nested folder. New ones are scanned in the same run rather than waiting for the next interval.
+An OPML is recognised by its content, so a URL without a `.opml` extension still works.
+
+When a feed drops out of the OPML upstream:
+
+| it has downloads | what happens |
+|---|---|
+| no | unsubscribed and removed from the config |
+| yes | kept, flagged in the UI as no longer listed |
+
+A downloaded file is never left behind with nothing explaining where it came from.
+
 ## Web UI
 
 ```toml