Cut what the audit found: dead columns, one-time upgrades, three deps

Works through TODO.md from the 2026-09-12 over-engineering audit. Drops the
entries.read/flagged/position columns (migrate() removes them from older
databases), migrate_opml_children, the legacy interval_mins key, the
contrib/ systemd units, test-only Db wrappers, a duplicate token generator,
redundant logbuf visitors, unused page state and CSS, and the infer, dirs
and tokio-stream dependencies. The icon is served once as /icon.png instead
of inlined four times, taking about 94 KB off the two pages.

The adoption's subscription half was not dead: it gives a fresh install's
first admin the config's feeds. It stays as adopt_catalogue, now tested.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TAC7sLVqfKmY6rsTLXzNgk

src/web.rs

@@ -12,9 +12,7 @@ use axum::{
     },
     routing::{delete, get, patch, post},
 };
-use futures_util::StreamExt;
 use serde::Deserialize;
-use tokio_stream::wrappers::BroadcastStream;
 use tower::ServiceExt;
 use tower_http::services::ServeFile;
 use serde::Serialize;
@@ -35,28 +33,6 @@ pub struct WebState {
     pub events: broadcast::Sender<Event>,
 }
 
-/// A 32-hex-character shared secret, generated when config.toml has none.
-///
-/// ponytail: /dev/urandom rather than a CSPRNG crate -- 16 bytes, once, on a Unix-only
-/// binary. Falls back to the clock only if urandom is somehow unreadable, which would be a
-/// weak token, so that case is logged loudly.
-pub fn generate_token() -> String {
-    use std::io::Read;
-    let mut bytes = [0u8; 16];
-    match std::fs::File::open("/dev/urandom").and_then(|mut f| f.read_exact(&mut bytes)) {
-        Ok(()) => {}
-        Err(e) => {
-            tracing::error!(error = %e, "could not read /dev/urandom; token is NOT secure");
-            let n = std::time::SystemTime::now()
-                .duration_since(std::time::UNIX_EPOCH)
-                .map(|d| d.as_nanos() as u64)
-                .unwrap_or(0);
-            bytes[..8].copy_from_slice(&n.to_le_bytes());
-        }
-    }
-    bytes.iter().map(|b| format!("{b:02x}")).collect()
-}
-
 pub fn router(state: WebState) -> Router {
     Router::new()
         .route("/", get(index))
@@ -88,6 +64,7 @@ pub fn router(state: WebState) -> Router {
         // Signing in cannot require being signed in, so these sit outside the auth layer.
         .route("/login", get(login_page))
         .route("/api/login", post(login))
+        .route("/icon.png", get(icon))
         .layer(middleware::from_fn(access_log))
         .with_state(state)
 }
@@ -433,6 +410,15 @@ async fn login_page() -> Html<&'static str> {
     Html(include_str!("../web/login.html"))
 }
 
+/// The 2004 icon, served once for both pages rather than inlined as base64 into each. The
+/// sign-in page shows it, so it sits outside the auth layer with /login.
+async fn icon() -> impl IntoResponse {
+    (
+        [(header::CONTENT_TYPE, "image/png"), (header::CACHE_CONTROL, "max-age=86400")],
+        include_bytes!("../web/ipodderx-icon.png").as_slice(),
+    )
+}
+
 fn constant_time_eq(a: &str, b: &str) -> bool {
     let (a, b) = (a.as_bytes(), b.as_bytes());
     if a.len() != b.len() {
@@ -817,15 +803,6 @@ mod tests {
             "another feed already has that URL"
         );
     }
-
-    #[test]
-    fn generated_tokens_are_32_hex_chars_and_not_repeated() {
-        let a = generate_token();
-        let b = generate_token();
-        assert_eq!(a.len(), 32);
-        assert!(a.chars().all(|c| c.is_ascii_hexdigit()));
-        assert_ne!(a, b);
-    }
 }
 
 #[derive(Deserialize)]
@@ -1247,9 +1224,20 @@ async fn fetch_now(
 
 /// The same broadcast the socket clients read, as server-sent events.
 async fn events(State(state): State<WebState>) -> Sse<impl futures_util::Stream<Item = Result<SseEvent, std::convert::Infallible>>> {
-    let stream = BroadcastStream::new(state.events.subscribe()).filter_map(|ev| async move {
-        let ev = ev.ok()?;
-        Some(Ok(SseEvent::default().data(serde_json::to_string(&ev).ok()?)))
+    // A client that falls behind skips what it missed rather than being cut off.
+    let stream = futures_util::stream::unfold(state.events.subscribe(), |mut rx| async move {
+        loop {
+            match rx.recv().await {
+                Ok(ev) => {
+                    if let Ok(data) = serde_json::to_string(&ev) {
+                        let ev = Ok::<_, std::convert::Infallible>(SseEvent::default().data(data));
+                        return Some((ev, rx));
+                    }
+                }
+                Err(broadcast::error::RecvError::Lagged(_)) => {}
+                Err(broadcast::error::RecvError::Closed) => return None,
+            }
+        }
     });
     Sse::new(stream).keep_alive(axum::response::sse::KeepAlive::default())
 }
@@ -1460,8 +1448,6 @@ async fn patch_settings(
             )));
         }
         cfg.general.schedule = sched;
-        // The legacy key would otherwise keep shadowing intent in the file.
-        cfg.general.interval_mins = None;
     }
     if let Some(v) = body.max_new_per_check {
         cfg.general.max_new_per_check = v;