test(e2e): de-vacuum security tests; add quota, authz-sweep, keepsake-regen coverage

An audit found tests that pass on broken code. The dominant pattern: fire a security
assertion at the all-zeros UUID and accept [403, 404] — the 404 comes from the resource
LOOKUP, not the guard, so the guard can be deleted and the test still passes. Repaired to
use real resources and demand exactly 403:
  - banned-user cannot like / comment (the only coverage of those ban invariants)
  - host cannot promote a real guest (or self) to admin — asserts nobody's role changed
  - IDOR comment-delete already used a real resource; kept
Also inverted recovery.spec's "unknown name → nicht gefunden" test: that asserted the exact
account-enumeration oracle the F4 fix removed, so restoring the vuln would have made it
pass. Now: an unknown name must be byte-identical to a wrong PIN.

New coverage for paths that ran in production but in zero tests:
  - quota.spec.ts: storage quota enforcement (413 over-limit, atomic increment under two
    uploads held mid-body so both carry a stale total=0 — the real race; a naive Promise.all
    version was itself vacuous and is documented as such). Proven to fail without the guard.
  - authz-sweep.spec.ts: table-driven guest→403 / host→403 over ALL 19 privileged routes +
    anonymous + __truncate. No live hole found; the whole surface is now locked.
  - ban / unban / host-comment-delete AFTER release regenerate the keepsake (data-loss
    paths that were dead under test); comment-delete mid-build doesn't strand the ZIP.

Lower-severity de-vacuuming: 10 MB comment test hit Caddy's 502 before the real 500-char
cap (now seeds a real upload, 501→400 / 500→201, mutation-verified); XSS name payloads
shortened under the 50-char cap so they actually store+render; ui-rendering XSS test now
proves the payload rendered before asserting no <b>; export page-object locators fixed to
the real "Download" label with a positive empty-state anchor; avatar palette spread test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/avatar.test.ts

@@ -9,12 +9,36 @@ describe('avatarPalette', () => {
   });
 
   it('is deterministic for the same name', () => {
+    // Same input, repeated calls AND a separately-constructed equal string — the palette
+    // must be a pure function of the name's characters, not of identity or call order.
     expect(avatarPalette('Alice')).toBe(avatarPalette('Alice'));
+    expect(avatarPalette('Alice')).toBe(avatarPalette('Ali' + 'ce'));
+    expect(avatarPalette('Zoë Müller')).toBe(avatarPalette('Zoë Müller'));
   });
 
   it('returns a real palette entry (not neutral) for a non-empty name', () => {
     expect(avatarPalette('Bob')).toMatch(/bg-(blue|purple|green|amber|rose|teal)-100/);
   });
+
+  it('maps different names to different palette entries', () => {
+    // Without this, `name => name ? PALETTE[0] : NEUTRAL` (i.e. the hash loop deleted)
+    // passes every other test in this file — the palette would be a constant and every
+    // avatar in the app would render the same colour.
+    expect(avatarPalette('Alice')).not.toBe(avatarPalette('Bob'));
+  });
+
+  it('spreads names across the whole palette, not just one bucket', () => {
+    const names = [
+      'Alice', 'Bob', 'Carol', 'Dave', 'Erin', 'Frank', 'Grace', 'Heidi',
+      'Ivan', 'Judy', 'Mallory', 'Niaj', 'Olivia', 'Peggy', 'Rupert', 'Sybil',
+      'Trent', 'Victor', 'Walter', 'Xena'
+    ];
+    const distinct = new Set(names.map((n) => avatarPalette(n)));
+    // 6 colours in the palette; 20 names must land on more than a couple of them. This
+    // catches a hash that collapses (e.g. always returns index 0, or ignores all but the
+    // first character in a way that clusters).
+    expect(distinct.size).toBeGreaterThanOrEqual(4);
+  });
 });
 
 describe('initials', () => {