test(e2e): de-vacuum security tests; add quota, authz-sweep, keepsake-regen coverage

An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
  - banned-user cannot like / comment (the only coverage of those ban invariants)
  - host cannot promote a real guest (or self) to admin — asserts nobody's role changed
  - IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.

New coverage for paths that ran in production but in zero tests:
  - quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
    uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
    version was itself vacuous and is documented as such). Proven to fail without the guard.
  - authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
    anonymous + __truncate. No live hole found; the whole surface is now locked.
  - ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
    paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.

Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/10-flow-review/export-reopen-rerelease.spec.ts

@@ -421,6 +421,103 @@ test.describe('Flow re-review — reopen→re-release export integrity + stale-k
     expect(listing.some((n) => n.includes(keep)), 'the kept photo survives').toBe(true);
   });
 
+  test('BANNING a guest after release removes their photos from the keepsake', async ({
+    api,
+    host,
+    guest,
+  }) => {
+    // `ban_user` calls `invalidate_and_arm(Affects::Both)` — but every ban in the suite ran against
+    // an UNRELEASED event, where `invalidate_and_arm` returns early. So this regeneration path was
+    // dead code under test.
+    //
+    // The stakes are the whole point of a ban: the host bans someone for posting something abusive,
+    // and if the keepsake doesn't rebuild, that content stays in the archive every guest downloads,
+    // forever. The export query already filters `is_banned` — so the pipeline AGREES the content
+    // shouldn't be there; only the regeneration was missing.
+    const offender = await guest('Offender');
+    const innocent = await guest('Innocent');
+    const badPhoto = await seedUpload(offender.jwt, { caption: 'abusive' });
+    const goodPhoto = await seedUpload(innocent.jwt, { caption: 'lovely' });
+
+    expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(204);
+    await waitExportDone(host.jwt);
+    expect(await downloadZipEntries(host.jwt)).toHaveLength(2);
+
+    await api.banUser(host.jwt, offender.userId);
+
+    await waitExportDone(host.jwt);
+    const listing = await downloadZipEntries(host.jwt);
+    expect(
+      listing.some((n) => n.includes(badPhoto)),
+      "a banned guest's photo must not survive in the keepsake everyone downloads"
+    ).toBe(false);
+    expect(listing.some((n) => n.includes(goodPhoto)), 'everyone else keeps their photos').toBe(true);
+    expect(listing).toHaveLength(1);
+  });
+
+  test('UNBANNING a guest after release restores their photos to the keepsake', async ({
+    api,
+    host,
+    guest,
+  }) => {
+    // The mirror image, and the one that LOSES data. A host bans someone by mistake (or bans, then
+    // reconsiders) — unban must put their photos back into the archive. If the regeneration is
+    // missing, that guest's photos are absent from the keepsake everyone keeps, and after the
+    // wedding they are gone: the export is the only copy anyone takes home.
+    const g = await guest('Forgiven');
+    const photo = await seedUpload(g.jwt, { caption: 'restore me' });
+    await seedUpload(host.jwt, { caption: 'host photo' });
+
+    await api.banUser(host.jwt, g.userId);
+    expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(204);
+    await waitExportDone(host.jwt);
+    // Banned at release time → their photo is correctly absent.
+    expect(await downloadZipEntries(host.jwt)).toHaveLength(1);
+
+    const unban = await post(`/api/v1/host/users/${g.userId}/unban`, host.jwt);
+    expect(unban.status).toBe(204);
+
+    await waitExportDone(host.jwt);
+    const listing = await downloadZipEntries(host.jwt);
+    expect(
+      listing.some((n) => n.includes(photo)),
+      'an unbanned guest must get their photos back in the keepsake — it is the only copy anyone keeps'
+    ).toBe(true);
+    expect(listing).toHaveLength(2);
+  });
+
+  test('a HOST comment takedown after release keeps the keepsake downloadable', async ({
+    host,
+    guest,
+  }) => {
+    // `DELETE /host/comment/{id}` had ZERO test hits of any kind, and it is one of the two callers
+    // of the ViewerOnly carry-forward. A comment doesn't live in the ZIP (which holds media), so the
+    // ZIP must be CARRIED FORWARD, not rebuilt — but it must still be downloadable afterwards, and
+    // the viewer must lose the comment.
+    const g = await guest('Rude');
+    const uploadId = await seedUpload(host.jwt, { caption: 'pic' });
+    const cRes = await fetch(BASE + `/api/v1/upload/${uploadId}/comments`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${g.jwt}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ body: 'unfreundlich' }),
+    });
+    const commentId = (await cRes.json()).id;
+
+    expect((await post('/api/v1/host/gallery/release', host.jwt)).status).toBe(204);
+    await waitExportDone(host.jwt);
+
+    const del = await fetch(BASE + `/api/v1/host/comment/${commentId}`, {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    expect(del.status).toBe(204);
+
+    // The keepsake must still be downloadable, with its media intact.
+    await waitExportDone(host.jwt);
+    expect(await downloadZipEntries(host.jwt)).toHaveLength(1);
+    expect(await zipJobEpoch()).toBe(await eventEpoch());
+  });
+
   test('a comment deleted while the ZIP is still BUILDING does not strand the ZIP', async ({
     host,
     guest,