test(e2e): de-vacuum security tests; add quota, authz-sweep, keepsake-regen coverage

An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
  - banned-user cannot like / comment (the only coverage of those ban invariants)
  - host cannot promote a real guest (or self) to admin — asserts nobody's role changed
  - IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.

New coverage for paths that ran in production but in zero tests:
  - quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
    uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
    version was itself vacuous and is documented as such). Proven to fail without the guard.
  - authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
    anonymous + __truncate. No live hole found; the whole surface is now locked.
  - ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
    paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.

Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/07-adversarial/authorization-deep.spec.ts

@@ -80,27 +80,39 @@ test.describe('Adversarial — deep authorization', () => {
     expect(row?.caption).toBe('original caption');
   });
 
+  // These two fire at a REAL upload, and demand exactly 403.
+  //
+  // They used to POST to the all-zeros UUID and accept `[403, 404]`. Both handlers check
+  // `user.is_banned` BEFORE they look the upload up (social.rs) — so the 404 came from the
+  // *lookup*, not the guard. Delete the ban check entirely and the request still 404s on the
+  // nonexistent upload, and both tests still passed. They were the only coverage of
+  // ban-blocks-like and ban-blocks-comment, and they guarded nothing.
   test('banned user cannot toggle a like', async ({ api, host, guest }) => {
     const target = await guest('BannedLike');
+    const uploadId = await seedUpload(host.jwt, { caption: 'likeable' });
     await api.banUser(host.jwt, target.userId);
 
-    const res = await fetch(`${BASE}/api/v1/upload/00000000-0000-0000-0000-000000000000/like`, {
+    const res = await fetch(`${BASE}/api/v1/upload/${uploadId}/like`, {
       method: 'POST',
       headers: { Authorization: `Bearer ${target.jwt}` },
     });
-    expect([403, 404]).toContain(res.status);
+    expect(res.status, 'a banned user must be Forbidden, not merely miss the resource').toBe(403);
   });
 
   test('banned user cannot post a comment', async ({ api, host, guest }) => {
     const target = await guest('BannedComment');
+    const uploadId = await seedUpload(host.jwt, { caption: 'commentable' });
     await api.banUser(host.jwt, target.userId);
 
-    const res = await fetch(`${BASE}/api/v1/upload/00000000-0000-0000-0000-000000000000/comments`, {
+    const res = await fetch(`${BASE}/api/v1/upload/${uploadId}/comments`, {
       method: 'POST',
       headers: { Authorization: `Bearer ${target.jwt}`, 'Content-Type': 'application/json' },
       body: JSON.stringify({ body: 'should be rejected' }),
     });
-    expect([403, 404]).toContain(res.status);
+    expect(res.status, 'a banned user must be Forbidden, not merely miss the resource').toBe(403);
+
+    // ...and nothing was written.
+    expect(await listComments(host.jwt, uploadId)).toHaveLength(0);
   });
 
   test('banned user can still read the feed (read-only access preserved)', async ({ api, host, guest }) => {
@@ -130,15 +142,40 @@ test.describe('Adversarial — deep authorization', () => {
     expect(stillWorks.status).toBe(200);
   });
 
-  test('promote endpoint cannot be used to make oneself admin', async ({ host }) => {
-    const res = await fetch(`${BASE}/api/v1/host/users/${'00000000-0000-0000-0000-000000000000'}/role`, {
+  // Privilege escalation, tested against REAL targets.
+  //
+  // The old version PATCHed the all-zeros UUID and accepted `[400, 403, 404]`. The role whitelist
+  // rejects "admin" with a 400 before the target is ever looked up — so adding `"admin"` to the
+  // whitelist would make the request 404 on the nonexistent user instead, which was in the accepted
+  // list. It never promoted anyone, never targeted *oneself*, and could not detect escalation.
+  test('a host cannot promote a real guest to admin', async ({ api, host, guest, adminToken }) => {
+    const victim = await guest('EscalationTarget');
+
+    const res = await fetch(`${BASE}/api/v1/host/users/${victim.userId}/role`, {
       method: 'PATCH',
       headers: { Authorization: `Bearer ${host.jwt}`, 'Content-Type': 'application/json' },
       body: JSON.stringify({ role: 'admin' }),
     });
-    // 400 (invalid role for host-callable endpoint) or 403/404.
-    expect([400, 403, 404]).toContain(res.status);
-    // Critically, NOT 200/204.
-    expect([200, 204]).not.toContain(res.status);
+    expect(res.status).not.toBe(204);
+    expect(res.status).not.toBe(200);
+
+    // The assertion that actually matters: nobody got promoted.
+    const users = await api.listUsers(adminToken);
+    const row = users.find((u: any) => u.id === victim.userId);
+    expect(row?.role, 'the guest must NOT have become an admin').not.toBe('admin');
+  });
+
+  test('a host cannot promote THEMSELVES to admin', async ({ api, host, adminToken }) => {
+    const res = await fetch(`${BASE}/api/v1/host/users/${host.userId}/role`, {
+      method: 'PATCH',
+      headers: { Authorization: `Bearer ${host.jwt}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ role: 'admin' }),
+    });
+    expect(res.status).not.toBe(204);
+    expect(res.status).not.toBe(200);
+
+    const users = await api.listUsers(adminToken);
+    const me = users.find((u: any) => u.id === host.userId);
+    expect(me?.role, 'the host must NOT have self-promoted to admin').not.toBe('admin');
   });
 });