Never list paid-feed services; scan on add; no "reaped"; slimmer header

- Security: feeds from Patreon, Supercast, Supporting Cast, Glow and
  Memberful are never listed in Popular or the Directory. A Supercast
  feed keeps its key in the URL's path, which the query check missed, so
  it was being listed.
- Adding a feed queues a scan of it, and an OPML import that added feeds
  scans what is due, so items show without pressing Scan.
- A file deleted to save space, or by hand, looks as if it was never
  downloaded: no "reaped" chip, just the Download button. The retention
  summary says "deleted".
- The feed header keeps its title and stats to one line each and wraps
  its buttons; a single feed's table drops the Feed column.
- Tests: adding a feed shows its item without Scan; a deleted file shows
  no "reaped"; paid-feed hosts and acast public ids in the unit test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016HdTEWQNrzyFULijigkmMn

docs/history.md

@@ -52,6 +52,13 @@ with everything else, so this is built around not doing that:
   the URL, or a query key containing `auth`, `token`, `key`, `secret`, `pass`, `sig`, `session`,
   `user` or `uid`. It is a heuristic, and a token hidden in the URL's path gets through. A per-feed
   `unlisted` flag is the upgrade if that happens.
+
+  It happened the same day. The first screenshot of the new Directory listed "Glass Cannon Live!
+  Ascension (for Ray Slakinski)", a Supercast feed at `feeds.supercast.com/feeds/<key>`. Treating
+  any long path segment as a key would have hidden public feeds too: acast's show ids look the
+  same. So paid-feed services are named instead (Patreon, Supercast, Supporting Cast, Glow,
+  Memberful), and any feed from one of them is private whatever its URL looks like. The per-feed
+  flag is still the upgrade for a service not on that list.
 - Feeds from an OPML are left out. Everyone subscribed to an OPML counts every feed inside it, so
   they would bury everything anyone chose on purpose.
 

docs/users.md

@@ -76,7 +76,8 @@ included. Directory lists every one of them A to Z. Your own feeds are marked Su
 It shows a title, artwork and a count, never a URL or who reads it. Feeds from an
 OPML subscription are left out, since they come with the OPML. So is anything that looks private: a
 login configured for the feed, credentials in its URL, or a key such as `auth=` or `token=` in the
-query. Those are someone's paid subscriptions, and listing them would let anyone here read what they
+query, or a feed from a paid-feed service such as Patreon or Supercast, which put the key in the
+path. Those are someone's paid subscriptions, and listing them would let anyone here read what they
 pay for.
 
 An admin can do the same from **Settings → Manage users…**: add someone (with a password, or none