fix(review-2): address re-review — close two blocker regressions + harden tests

The round-2 re-review (full suite green) found two real defects the passing
tests missed, both now fixed and covered:

B1 — banned users could still edit/delete their OWN content: edit_upload,
     delete_upload, delete_comment skipped the is_banned guard that upload/
     like/comment got (round-2 removed the global extractor block and missed
     these three). Added the guard (using auth.is_banned — no extra query).
     The moderation ban test now asserts 403 on DELETE upload, PATCH upload,
     and DELETE comment for a banned owner (+ upload survives) — it previously
     only exercised POST /upload, which is why the gap shipped green.

B2 — H3 live-eviction was dead code: 'user-hidden' and 'comment-deleted' were
     missing from KNOWN_EVENTS, so EventSource never listened and the handlers
     never fired. Added both. New browser-driven sse-eviction test asserts a
     hidden user's card actually evicts from an open feed with no reload — the
     backend-only SseListener checks couldn't catch this.

Minor items folded in:
- admin dashboard bounces a mid-session-demoted admin to /feed via live
  /me/context (mirrors the host page) instead of a dead error screen.
- feed "new posts" pill cleared on any full refresh (pull-to-refresh no longer
  strands it).
- corrected the stale sse.rs comment (banned users may hold a read-only stream).

Verified: backend 35 unit tests; svelte-check 0 errors; e2e 04-host + comment-ui
+ export-leak 13/13 on chromium (incl. the two new regression tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/moderation.spec.ts

@@ -4,6 +4,7 @@
  * coverage of the buttons lives in a separate UI-focused spec.
  */
 import { test, expect } from '../../fixtures/test';
+import { seedUpload, seedComment } from '../../helpers/seed';
 
 test.describe('Host — moderation API', () => {
   test('ban with hide_uploads=true sets the right flags', async ({ api, host, guest }) => {
@@ -104,20 +105,52 @@ test.describe('Host — live role/ban revocation (H1)', () => {
   test('a banned user keeps read access but is blocked from writes', async ({ api, host, guest }) => {
     const base = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
     const target = await guest('BannedRW');
+    const auth = (jwt: string) => ({ Authorization: `Bearer ${jwt}` });
+
+    // Seed content the target OWNS *before* the ban, so the delete/edit paths get
+    // past the ownership check and it's genuinely the ban guard being exercised.
+    const ownUpload = await seedUpload(target.jwt, { caption: 'mine' });
+    const ownComment = await seedComment(target.jwt, ownUpload, 'my comment');
+
     await api.banUser(host.jwt, target.userId, false);
 
     // Reads still succeed.
-    const read = await fetch(base + '/api/v1/me/context', {
-      headers: { Authorization: `Bearer ${target.jwt}` },
-    });
+    const read = await fetch(base + '/api/v1/me/context', { headers: auth(target.jwt) });
     expect(read.status).toBe(200);
 
-    // Writes are rejected.
-    const write = await fetch(base + '/api/v1/upload', {
+    // Every write is rejected — cover ALL guest-reachable mutations, not just
+    // /upload. delete_upload / delete_comment / edit_upload previously skipped the
+    // ban guard (a banned owner could still delete/edit their own content).
+    const create = await fetch(base + '/api/v1/upload', {
       method: 'POST',
-      headers: { Authorization: `Bearer ${target.jwt}` },
+      headers: auth(target.jwt),
       body: new FormData(),
     });
-    expect(write.status).toBe(403);
+    expect(create.status).toBe(403);
+
+    const delUpload = await fetch(base + `/api/v1/upload/${ownUpload}`, {
+      method: 'DELETE',
+      headers: auth(target.jwt),
+    });
+    expect(delUpload.status).toBe(403);
+
+    const editUpload = await fetch(base + `/api/v1/upload/${ownUpload}`, {
+      method: 'PATCH',
+      headers: { ...auth(target.jwt), 'Content-Type': 'application/json' },
+      body: JSON.stringify({ caption: 'edited while banned' }),
+    });
+    expect(editUpload.status).toBe(403);
+
+    const delComment = await fetch(base + `/api/v1/comment/${ownComment}`, {
+      method: 'DELETE',
+      headers: auth(target.jwt),
+    });
+    expect(delComment.status).toBe(403);
+
+    // The upload survived every blocked write (still fetchable via the feed).
+    const feed = await fetch(base + '/api/v1/feed', { headers: auth(host.jwt) });
+    const body = await feed.json();
+    const rows = body.uploads ?? body.items ?? body;
+    expect(Array.isArray(rows) && rows.some((u: any) => u.id === ownUpload)).toBe(true);
   });
 });

e2e/specs/04-host/sse-eviction.spec.ts

@@ -48,4 +48,28 @@ test.describe('Host — live SSE eviction (H3)', () => {
       (e) => e.data.user_id === target.userId
     );
   });
+
+  // Frontend regression: the broadcasts above are inert if the client never
+  // registers the event name (the KNOWN_EVENTS gap that shipped both eviction
+  // handlers as dead code). Drive a real browser feed and assert LIVE eviction —
+  // this fails if 'user-hidden' is missing from KNOWN_EVENTS, unlike the
+  // backend-only SseListener checks above.
+  test('a hidden user is evicted from an open feed without reload (frontend)', async ({
+    page,
+    api,
+    host,
+    guest,
+    signIn,
+  }) => {
+    const viewer = await guest('LiveEvictViewer');
+    const target = await guest('LiveEvictTarget');
+    await seedUpload(target.jwt, { caption: 'evict-me-live-xyz' });
+
+    await signIn(page, viewer); // lands on the event-wide /feed
+    await expect(page.getByText('evict-me-live-xyz').first()).toBeVisible();
+
+    // Host hides the target — the viewer's feed must drop the card via SSE, no reload.
+    await api.banUser(host.jwt, target.userId, true);
+    await expect(page.getByText('evict-me-live-xyz')).toHaveCount(0, { timeout: 15_000 });
+  });
 });