fix(review-2): address re-review — close two blocker regressions + harden tests

The round-2 re-review (full suite green) found two real defects the passing
tests missed, both now fixed and covered:

B1 — banned users could still edit/delete their OWN content: edit_upload,
     delete_upload, delete_comment skipped the is_banned guard that upload/
     like/comment got (round-2 removed the global extractor block and missed
     these three). Added the guard (using auth.is_banned — no extra query).
     The moderation ban test now asserts 403 on DELETE upload, PATCH upload,
     and DELETE comment for a banned owner (+ upload survives) — it previously
     only exercised POST /upload, which is why the gap shipped green.

B2 — H3 live-eviction was dead code: 'user-hidden' and 'comment-deleted' were
     missing from KNOWN_EVENTS, so EventSource never listened and the handlers
     never fired. Added both. New browser-driven sse-eviction test asserts a
     hidden user's card actually evicts from an open feed with no reload — the
     backend-only SseListener checks couldn't catch this.

Minor items folded in:
- admin dashboard bounces a mid-session-demoted admin to /feed via live
  /me/context (mirrors the host page) instead of a dead error screen.
- feed "new posts" pill cleared on any full refresh (pull-to-refresh no longer
  strands it).
- corrected the stale sse.rs comment (banned users may hold a read-only stream).

Verified: backend 35 unit tests; svelte-check 0 errors; e2e 04-host + comment-ui
+ export-leak 13/13 on chromium (incl. the two new regression tests).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/sse.ts

@@ -38,6 +38,8 @@ const KNOWN_EVENTS = [
 	'upload-deleted',
 	'like-update',
 	'new-comment',
+	'comment-deleted',
+	'user-hidden',
 	'event-closed',
 	'event-opened',
 	'event-updated',

frontend/src/routes/admin/+page.svelte

@@ -158,8 +158,22 @@
 
 	onMount(async () => {
 		const token = getToken();
-		const role = getRole();
-		if (!token || role !== 'admin') {
+		if (!token) {
+			goto('/admin/login');
+			return;
+		}
+		// Trust the *live* role, not the JWT claim: a mid-session demote leaves a
+		// stale 'admin' in the token, but the backend now 403s every admin call.
+		// Bounce a demoted admin to the feed instead of leaving them on a dashboard
+		// that errors on load (mirrors the host page).
+		try {
+			const ctx = await api.get<{ role: string }>('/me/context');
+			if (ctx.role !== 'admin') {
+				goto('/feed');
+				return;
+			}
+		} catch {
+			// Expired/invalid session (api.ts cleared it) — send them to re-auth.
 			goto('/admin/login');
 			return;
 		}

frontend/src/routes/feed/+page.svelte

@@ -317,6 +317,10 @@
 	}
 
 	async function loadFeed(refresh = false) {
+		// Any full refresh (pill tap, pull-to-refresh, filter change) resyncs page 1,
+		// so the "new posts" pill is no longer relevant — clear it here rather than
+		// only in the pill's own onclick, or a pull-to-refresh leaves it stranded.
+		if (refresh) feedStale = false;
 		try {
 			const params = new URLSearchParams();
 			if (!refresh && nextCursor) params.set('cursor', nextCursor);