Cut what the audit found: dead columns, one-time upgrades, three deps

Works through TODO.md from the 2026-09-12 over-engineering audit. Drops the
entries.read/flagged/position columns (migrate() removes them from older
databases), migrate_opml_children, the legacy interval_mins key, the
contrib/ systemd units, test-only Db wrappers, a duplicate token generator,
redundant logbuf visitors, unused page state and CSS, and the infer, dirs
and tokio-stream dependencies. The icon is served once as /icon.png instead
of inlined four times, taking about 94 KB off the two pages.

The adoption's subscription half was not dead: it gives a fresh install's
first admin the config's feeds. It stays as adopt_catalogue, now tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

docs/history.md

@@ -6,6 +6,38 @@ reasoning lives. New write-ups go at the top.
 
 See [README.md](../README.md) for what the thing is.
 
+## 2026-09-12 — Cutting what had outlived its reason
+
+A whole-repo audit for over-engineering listed twelve things to cut, and all of them went.
+
+- **Upgrades from before accounts.** `migrate_opml_children` moved OPML feeds that old versions
+  wrote into `config.toml` out to the database, and ran at every daemon start to do nothing after
+  the first. Production ran it in 0.3.0; anything older has to pass through 0.4.0.
+- **Half of the adoption, and not the other half.** The audit called `adopt_existing_library` a
+  one-time migration and it was cut whole. It did two jobs: copy the old read state into
+  `entry_state`, which was dead, and subscribe the first admin to the whole catalogue while nobody
+  subscribed to anything, which is how a fresh install's first account gets `config.toml`'s feeds.
+  The browser suite caught it at once, signing in to an empty sidebar; `cargo test` had no idea.
+  The second job is back as `adopt_catalogue`, with a unit test of its own.
+- **The dead `entries` columns.** `read`, `flagged` and `position` moved to `entry_state` with
+  accounts. The adoption's copy was their last reader, but `record_entry` still wrote them, and
+  still reset `read` when a title changed, which nothing looked at. Two bugs came from queries
+  reading them. `migrate()` now drops them from an existing database (SQLite has had `DROP COLUMN`
+  since 3.35), and a test builds an old table to prove it.
+- **`interval_mins`**, which `schedule` replaced. An old config that still has the key loads; the
+  key is ignored, and the config test carries it to keep that true.
+- **Three dependencies.** `infer` was only asked whether a file is a torrent, and the check after
+  it already looked for `d8:announce`, which is what `infer` looks for. `dirs` was three lookups of
+  `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and `HOME`. `tokio-stream` wrapped the broadcast receiver for
+  the event stream; `futures_util::stream::unfold` does the same, lagging clients included.
+- **Two token generators.** The web token came from a copy of the session-token code, with a
+  clock fallback on top. It uses `auth::new_session_token` now, and is 64 characters.
+- **The icon inlined four times**, 23 KB of base64 each, into both pages. It is `/icon.png` now,
+  outside the sign-in wall with `/login`, since the sign-in page shows it.
+- Also: the `contrib/` systemd units from before the container, `Db::entries` and
+  `Db::count_entries` that only the tests called, three `logbuf` visitors that repeated the trait's
+  defaults, and unused state, a helper and dead CSS in the page.
+
 ## 2026-09-11 — A design pass on the web UI
 
 A review against screenshots of every view in all three themes found that Dark and Light read as a