A feed's credentials go to its own host alone (#327 #328)

feed::fetch already sent basic auth only to the feed's own host, but
two paths around it did not:

- download::download attached the feed's username and password to
  every enclosure, on whatever host the feed named: a CDN, or the
  measurement and ad-insertion prefixes podcasts route through (#328).
- subscriptions() and promote_kept() gave every feed an OPML or Patreon
  list derives the list's credentials, and fetch's same-host check then
  compared against the derived feed's own URL, so the list's password
  went to every host the OPML named, on every scan (#327).

config::Feed::auth_for and credentials_for compare hosts once, and
each of the three uses them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/configuration.md

@@ -160,6 +160,9 @@ With more than one account, **`keywords`, `auto_download`, `allow_explicit` and
 config.toml are the fallback for a feed nobody has claimed. The keys above describe the feed itself
 and are the same for everyone. See [users.md](users.md).
 
+`username` and its password go to the feed's own host alone: not to episodes on another host, nor to
+the feeds an OPML lists on other hosts, which would hand the password to whoever runs them.
+
 **The Directory** is the directory service's ([directory.md](directory.md)), which an admin sets
 up in Admin, Directory: its address, this server's token and whether to share. They are server
 settings, kept in the database (`directory_url`, `directory_token`, `directory_share`), not here.