Administer the directory from iPX with an rwa token (#206)

A Directory feed's page offers Check now and Remove to an admin whose token is rwa (the page
learns it from can_admin on the feed's page, asked of the directory only for admins). Admin,
Directory lists the servers sharing, from a new GET /v1/instances, and the blocked feeds by
title: a feed is often blocked because its address carries a key, so the address stays in the
directory. Unblocking or dropping a snapshot sends this server's snapshot again at once; since
directory's 403 reaches the page as 403, not 502.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -141,6 +141,8 @@ else a `401`. A feed's items and files (its entries, `download-latest`, `/api/en
 | `GET /api/opml`, `POST /api/opml` | export your subscriptions; subscribe to every feed in an OPML |
 | `GET /api/directory/{id}` | a feed's page from the directory service (#205), by the directory's id: its description and latest twenty items, sanitized here, and why its last check failed, in words; never a file or its address |
 | `GET /api/popular`, `GET /api/directory`, `POST /api/popular/{id}` | the directory service's ten most subscribed and every feed it lists, A to Z, asked by ipx with its token (directory id, title, art, subscribers across every sharing server, whether it is yours and its id here, category, whether it carries audio or video; never a URL); subscribe by the directory's id, which takes the feed's address from the directory. `503` with no directory set up |
+| `DELETE /api/directory/{id}`, `POST /api/directory/{id}/refresh` | admin-only, and the directory refuses unless this server's token is `rwa` (#206): remove and block a feed; check it now. `GET /api/directory/{id}` says `can_admin` when both hold |
+| `GET /api/directory-admin`, `DELETE /api/directory-blocked/{id}`, `DELETE /api/directory-instances/{name}` | admin-only, `rwa` (#206): the servers sharing (name, feeds, subscribers) and the blocked feeds (id, title, when; never the address, often why it was blocked); unblock; drop a server's snapshot. Unblocking or dropping sends this server's snapshot again at once |
 | `GET /api/directory-status` | admin-only: the name and access the directory gives this server's token, or why it refused, and how the last snapshot went |
 | `GET /api/settings`, `PATCH /api/settings` | admin-only to write. The directory's token is written, never read back: `directory_token_set` says whether there is one |
 | `GET /api/users`, `POST /api/users`, `PATCH /api/users/{id}`, `DELETE /api/users/{id}` | admin-only; the only admin cannot be demoted or removed |

docs/directory.md

@@ -21,13 +21,21 @@ ipx keeps the address and token with its other server settings, in its database
 again: the tab says it is set and offers to clear it. To replace one, make a new token on the
 directory, paste it over the old, then delete the old token's entry from the directory's config.
 
-With sharing on, ipx sends its snapshot after every scan, whenever the catalogue or these settings
-change, and every half hour: each feed checked at least once, with how many people here subscribe,
+With sharing on, ipx sends its snapshot when what it would send has changed (checked after every
+scan, and whenever the catalogue or these settings change), and every half hour regardless (#211): each feed checked at least once, with how many people here subscribe,
 and the category an admin gave a feed that names none. It never sends an OPML or a Patreon creator
 itself (their feeds go instead), or a private feed. A feed's settings have a **Private** switch for
 a paid feed iPX does not recognise by its address; anyone subscribed may turn it on, and only an
 admin off.
 
+When this server's token is `rwa`, its admins administer the directory from iPX (#206). A feed's
+page in the Directory has **Check now** and **Remove from the directory**, which blocks it so no
+server's snapshot brings it back. Admin, Directory lists the **Servers** sharing, by token name,
+with how many feeds and subscribers each gave, and **Blocked**, by title, with Unblock. Dropping a
+server's snapshot takes its feeds and counts out until it next shares; to keep a server out,
+revoke its token. An admin's own subscriptions open as their feeds, not as Directory pages, so
+removing one of those is done by marking it private, or from another admin's account.
+
 ## Tokens
 
 Everything but `/healthz` needs a token, sent as `Authorization: Bearer <token>`. Each one has a
@@ -109,6 +117,7 @@ blocks it, so no snapshot brings it back.
 | `POST /v1/snapshot` | rw | `[{"url", "subscribers"}]`, at most 20,000: replaces everything this token sent before; answers what it `accepted` and how many it refused as private, blocked or invalid |
 | `DELETE /v1/feeds/{id}` | rwa | remove and block |
 | `GET /v1/blocked`, `DELETE /v1/blocked/{id}` | rwa | what is blocked; unblock |
+| `GET /v1/instances` | rwa | each token holding a snapshot: its `name`, `feeds` and `subscribers` |
 | `DELETE /v1/instances/{name}` | rwa | drop one token's snapshot, its counts with it |
 | `POST /v1/feeds/{id}/refresh` | rwa | fetch the feed now, answering with its page |