Subscribe to an OPML, not just import one

A feed whose body sniffs as OPML is treated as a subscription list and
re-read on every scan, as iPodderX did. Listed feeds become real config
entries grouped under it, inherit its settings, land in one nested folder,
and are scanned in the same run.

When a feed leaves the OPML: removed if nothing was downloaded, kept and
flagged otherwise, so a downloaded file is never orphaned.

folder_for sanitized the whole folder string and would have flattened the
nesting; each segment is sanitized separately now, and a traversal still
cannot escape the download directory. Db::memory() also runs migrate(),
which it did not, so a migration-only column passed tests while missing in
production.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AdXho5tTkjFLeUXKbEjKBh

src/download.rs

@@ -268,17 +268,27 @@ fn unique_path(dir: &Path, name: &str) -> PathBuf {
 }
 
 /// Download folder for a feed: per-feed name, or per-day when organize = "date".
+///
+/// A folder may name more than one level ("Subscriptions/Some Show") -- feeds from a
+/// subscribed OPML nest under it -- so each segment is sanitized separately rather than
+/// letting the sanitizer eat the separator.
 pub fn folder_for(cfg: &Config, id: &str, feed_cfg: &FeedCfg, title: Option<&str>) -> String {
     match cfg.general.organize {
         Organize::Date => chrono::Local::now().format("%m-%d-%Y").to_string(),
-        Organize::Feed => sanitize(
-            feed_cfg
+        Organize::Feed => {
+            let raw = feed_cfg
                 .folder
                 .as_deref()
                 .or(title)
                 .filter(|s| !s.trim().is_empty())
-                .unwrap_or(id),
-        ),
+                .unwrap_or(id);
+            raw.split('/')
+                .map(str::trim)
+                .filter(|seg| !seg.is_empty() && *seg != "." && *seg != "..")
+                .map(sanitize)
+                .collect::<Vec<_>>()
+                .join("/")
+        }
     }
 }
 
@@ -370,6 +380,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_folder_can_nest_without_the_sanitizer_eating_the_separator() {
+        let mut cfg = Config::default();
+        cfg.general.download_dir = "/tmp".into();
+        let mut f = crate::config::Feed {
+            url: "u".into(), folder: Some("Subscriptions/Some | Show".into()), group: None,
+            schedule: None, keywords: vec![], allow_explicit: false, auto_download: true,
+            max_new_per_check: None, username: None, password: None, password_env: None,
+        };
+        assert_eq!(folder_for(&cfg, "id", &f, None), "Subscriptions/Some - Show");
+
+        // A traversal in a folder name must not climb out of the download directory.
+        f.folder = Some("../../etc/Show".into());
+        assert_eq!(folder_for(&cfg, "id", &f, None), "etc/Show");
+    }
+
     #[test]
     fn keyword_matching_is_or_across_keywords_and_and_within_one() {
         let kws = vec!["deep dive".to_string(), "interview".to_string()];