Cargo workspace: crates/ipx and a shared crates/feed (#202)

The first step of the split (#207). The daemon moves to crates/ipx unchanged;
feed.rs becomes crates/feed (ipx-feed), which the directory service (#204)
will share for its metadata refresher and its privacy check.

To stand alone, fetch takes the feed's address and its credentials instead
of ipx's config::Feed (config::Feed::auth gives them), collect_outlines
moves in with the OPML parsing, and the address half of looks_private is
feed::url_looks_private. ipx imports the crate as `feed` at its root, so
every crate::feed path is unchanged. The version is the workspace's, in the
root Cargo.toml.

Checked: cargo test on Postgres (118 + 29), tsc, page smoke, native bridge,
contrast and Playwright (72) pass; the image built from the new Dockerfile
is deployed and healthy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -89,7 +89,7 @@ running the command and kills the session (exit 144), which has happened more th
 There are three pages: the app (`web/index.html`), the admin page (`web/admin.html`, sent to
 admins only) and sign-in (`web/login.html`). The app and admin pages share one stylesheet,
 `web/app.css`, and their script is TypeScript in `web/src/`; `web/build.mjs` lists which files
-make up each page's script. `build.rs` runs
+make up each page's script. `crates/ipx/build.rs` runs
 `web/build.mjs`, which uses swc to strip the types and minify the script into `app.js` (and
 `login.js`), and minifies the page, and the results are `include_str!`d into the binary. The page
 loads its script as `/app.js?v=<hash of its contents>`, and `/app.css` the same way: the page is
@@ -205,7 +205,7 @@ Non-trivial logic leaves one runnable check behind. Pure functions (`merge_polic
 * `/api/settings` answering `200` does **not** mean the daemon is well — the web server is a
   different task. `ipx status` checks the control socket and the database; to see the worker
   getting through its jobs, watch for `scan complete` in the log.
-* **The database goes through SeaORM, and the entities in `src/entity.rs` are the schema.**
+* **The database goes through SeaORM, and the entities in `crates/ipx/src/entity.rs` are the schema.**
   `Db::open` creates any missing table or index from them (`create_missing`), on every `ipx`
   command, the healthcheck's `ipx status` included, so it must never write when nothing is
   missing: SeaORM's experimental schema sync dropped and remade an index on every open, the
@@ -236,7 +236,7 @@ a feature added and then reworked in the same release is one line saying what it
 Added; something added and taken out again before the release, or a fix for a bug no release ever
 had, is not there at all; and "instead of" and "no longer" compare with the last release, not with
 last week. Issue numbers stay, all of them, on the line that survives. Then rename `[Unreleased]` to
-`## [X.Y.Z] - YYYY-MM-DD` and open a new empty `[Unreleased]` above it, set `version` in `Cargo.toml` to `X.Y.Z` (dropping `-dev`), tag the commit
+`## [X.Y.Z] - YYYY-MM-DD` and open a new empty `[Unreleased]` above it, set `version` in the root `Cargo.toml` (`[workspace.package]`) to `X.Y.Z` (dropping `-dev`), tag the commit
 `vX.Y.Z`, and update the compare links at the bottom of the changelog. Then, in the next commit,
 set `version` to the next patch with `-dev` (after 0.9.0, `0.9.1-dev`), so a build between releases says so
 in the logo's tooltip instead of claiming to be the last release. The release that follows can