fix(review-2): address re-review — close two blocker regressions + harden tests

The round-2 re-review (full suite green) found two real defects the passing
tests missed, both now fixed and covered:

B1 — banned users could still edit/delete their OWN content: edit_upload,
     delete_upload, delete_comment skipped the is_banned guard that upload/
     like/comment got (round-2 removed the global extractor block and missed
     these three). Added the guard (using auth.is_banned — no extra query).
     The moderation ban test now asserts 403 on DELETE upload, PATCH upload,
     and DELETE comment for a banned owner (+ upload survives) — it previously
     only exercised POST /upload, which is why the gap shipped green.

B2 — H3 live-eviction was dead code: 'user-hidden' and 'comment-deleted' were
     missing from KNOWN_EVENTS, so EventSource never listened and the handlers
     never fired. Added both. New browser-driven sse-eviction test asserts a
     hidden user's card actually evicts from an open feed with no reload — the
     backend-only SseListener checks couldn't catch this.

Minor items folded in:
- admin dashboard bounces a mid-session-demoted admin to /feed via live
  /me/context (mirrors the host page) instead of a dead error screen.
- feed "new posts" pill cleared on any full refresh (pull-to-refresh no longer
  strands it).
- corrected the stale sse.rs comment (banned users may hold a read-only stream).

Verified: backend 35 unit tests; svelte-check 0 errors; e2e 04-host + comment-ui
+ export-leak 13/13 on chromium (incl. the two new regression tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/sse-eviction.spec.ts

@@ -48,4 +48,28 @@ test.describe('Host — live SSE eviction (H3)', () => {
       (e) => e.data.user_id === target.userId
     );
   });
+
+  // Frontend regression: the broadcasts above are inert if the client never
+  // registers the event name (the KNOWN_EVENTS gap that shipped both eviction
+  // handlers as dead code). Drive a real browser feed and assert LIVE eviction —
+  // this fails if 'user-hidden' is missing from KNOWN_EVENTS, unlike the
+  // backend-only SseListener checks above.
+  test('a hidden user is evicted from an open feed without reload (frontend)', async ({
+    page,
+    api,
+    host,
+    guest,
+    signIn,
+  }) => {
+    const viewer = await guest('LiveEvictViewer');
+    const target = await guest('LiveEvictTarget');
+    await seedUpload(target.jwt, { caption: 'evict-me-live-xyz' });
+
+    await signIn(page, viewer); // lands on the event-wide /feed
+    await expect(page.getByText('evict-me-live-xyz').first()).toBeVisible();
+
+    // Host hides the target — the viewer's feed must drop the card via SSE, no reload.
+    await api.banUser(host.jwt, target.userId, true);
+    await expect(page.getByText('evict-me-live-xyz')).toHaveCount(0, { timeout: 15_000 });
+  });
 });