Only a subscriber or an admin marks a feed private (#333)

patch_feed let private = true through for anyone signed in, as the
field's doc comment meant for subscribers, but never checked that the
caller subscribed. Ids are slugs of titles, so anyone could mark
another person's feed, or a whole OPML (whose shows go with it),
private, keeping it out of the directory, and promote a derived feed
they did not read out of its OPML; only an admin could undo either.

A non-admin now needs a subscription to the feed, or gets 404, as the
per-person settings above already do.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/ui/app.spec.js

@@ -694,6 +694,8 @@ test('a second person has their own feeds and their own read state', async ({ br
   // Hiding the way in is not the guard; the server is.
   expect((await page.request.get('/api/users')).status()).toBe(403);
   expect((await page.request.get('/api/logs')).status()).toBe(403);
+  // Nor may Sam mark a feed they do not read private, keeping it out of the directory (#333).
+  expect((await page.request.patch('/api/feeds/test-show', { data: { private: true } })).status()).toBe(404);
 
   // Subscribing to a feed the admin already has costs no second fetch: same feed, same
   // files, but Sam's own read state.