fix: close the nine ways an unattended event loses photos or dies

Every one of these was found in the pre-event audit, verified against source, and
survives to production on the current main. Grouped by what actually goes wrong.

PHOTOS DISAPPEAR

* compression.rs no longer soft-deletes on a failed derivative. The guest got a
  201, watched the card appear, then watched it vanish — the row left v_feed,
  find_visible_media and BOTH keepsakes, while its bytes sat on disk for 14 days
  waiting for a cleanup nothing announced. No screen anywhere lists compression
  failures, so recovery meant hand-written SQL that also had to re-add the
  refunded quota. Now it does exactly what the ENOSPC arm beside it already did
  and documented as correct: keep the row, serve the original, retry on the next
  boot (bounded by derivative_attempts). `upload-deleted` is no longer emitted;
  `upload-processed` is, so the card re-renders instead of sitting on a
  placeholder.

* A 413 is now a reversible lock, so the blob survives. The quota moves — free
  disk falls, uploader count rises — so a guest goes over it having done nothing,
  and treating that as permanent meant a 400 MB video was pushed across cellular
  in full and THEN deleted from IndexedDB. Gone on both sides, and unrecoverable
  for an in-app camera capture that exists nowhere else.

* quota_limit_bytes gained a floor and a stable divisor. The ceiling used to
  decrease monotonically all evening; it now settles at max(uploaders,
  estimated_guest_count) — a config key that was seeded, validated in the admin
  whitelist, and read by no code at all. The floor is clamped to what the disk
  can actually back, so a full volume still yields zero rather than handing out
  an allowance it cannot honour.

* Because that floor gives up the aggregate guarantee the formula used to imply,
  uploads now check a hard 10 GB reserve first, independent of every quota
  toggle. postgres_data, media_data and exports_data share one filesystem: the
  end state was not a degraded feature, it was Postgres unable to write WAL.

THE ARCHIVE DISAPPEARS

* prune_superseded_archives runs only after the new generation lands. It ran
  before the preflight, reasoning the old archive was already unreachable — true
  of reachability, false of recoverability. An epoch is a value that can be
  rolled back; deleted bytes cannot. Any failed rebuild left the event with NO
  keepsake at all.

* The export preflight reserves the same 10 GB. `free < needed` authorised an
  export sized at exactly free, which ran for half an hour and landed the box at
  zero with the keepsake still unfinished.

THE APP DIES

* The feed reconcile re-reads the id set after its awaits instead of reusing one
  captured up to three round-trips earlier. The new-upload SSE handler prepends
  during exactly that window, so the row was both already present and absent from
  the stale set — prepended twice, and a duplicate key in a keyed {#each} throws
  in production, not just dev. The SSE handler and loadMore now dedupe too.

* Added routes/+error.svelte. Without it any uncaught error fell through to
  SvelteKit's unstyled English 500 with no reload control — inside a chromeless
  standalone PWA with no URL bar, for the rest of the evening.

THE OPERATOR IS LOCKED OUT

* admin_login verifies the password BEFORE charging the rate bucket, and a
  correct password is never throttled. The old order made this a denial of
  service against its own operator: every guest shares one NAT IP, the check ran
  first, so five requests a minute from any phone in the room kept the bucket
  full — and the escape hatch needed the admin session being blocked. A generous
  separate ceiling still bounds bcrypt CPU.

THE PROJECTOR DIES

* The preload budget is now strictly inside the dwell. At the 3s option the 4s
  budget could never land a commit on a slow uplink, so the wall froze on one
  photo while the queue drained silently behind it.

* The wake lock retries every 30s while visible, and the page says so on screen
  when the browser has no wake lock API. visibilitychange was the only retry
  trigger and a kiosk never changes visibility, so one refusal — iOS in Low Power
  Mode, say — was permanent.

* Caddy: /api/v1/upload/*/display joins the cacheable carve-out. The backend set
  max-age=300 on it and the blanket no-store silently replaced it, so a projector
  re-fetched a full-size JPEG per slide, ~2-4 GB over an evening on the uplink
  the guests are uploading over.

Also removes Upload::soft_delete, now unreferenced and an unscoped footgun next
to soft_delete_in_event.

Verified: 146/146 backend tests against a live Postgres, clippy clean, 51/51
vitest, svelte-check 0 errors, eslint clean, vite build, caddy validate, compose
YAML parse.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/routes/diashow/+page.svelte

@@ -13,6 +13,20 @@
 	const DWELL_OPTIONS = [3000, 6000, 10000];
 	// Cap on how long we wait for the next image to decode before showing it anyway.
 	const PRELOAD_TIMEOUT_MS = 4000;
+	// How far inside the dwell the preload budget must finish.
+	//
+	// `advance()` starts the preload and `scheduleNext()` starts the dwell timer together, and
+	// `commit()` is discarded if the slide token has moved on. So whenever the preload budget
+	// is >= the dwell, a screen whose images consistently decode slowly (cold cache on a
+	// congested venue uplink — the normal state for a projector on party wifi) can never land
+	// a commit: at 3s dwell the 4s preload is discarded, the next one gets 4s and is discarded
+	// at 6s, forever. The wall sticks on one photo for the rest of the night while the queue
+	// drains silently behind it, and nothing on screen says anything is wrong.
+	//
+	// Bounding the budget strictly below the dwell means the timeout always fires first and
+	// commits whatever it has — a possibly-undecoded image is a far better outcome than a
+	// frozen wall that needs a human.
+	const PRELOAD_HEADROOM_MS = 500;
 	// If every source for a slide is unreadable we skip it — but bail out of skipping after
 	// this many in a row so a total media outage can't hot-loop the show.
 	const MAX_CONSECUTIVE_SKIPS = 5;
@@ -41,6 +55,10 @@
 	// Consecutive slides skipped because no source decoded — reset the moment one shows.
 	let consecutiveSkips = 0;
 	let dwellMs = $state(6000);
+	// Set when the browser has no Screen Wake Lock API at all (Firefox, Safari < 16.4, most TV
+	// browsers). The operator sets this screen up once and walks away, so a silent no-op meant
+	// discovering the OS had dimmed the projector only by looking at it.
+	let wakeLockUnsupported = $state(false);
 	let transitionId = $state('crossfade');
 	let paused = $state(false);
 	let showOverlay = $state(false);
@@ -177,7 +195,12 @@
 				clearTimeout(timer);
 				action();
 			};
-			timer = setTimeout(() => done(() => commit(candidates[i])), PRELOAD_TIMEOUT_MS);
+				// Always strictly less than the dwell — see PRELOAD_HEADROOM_MS.
+				const preloadBudget = Math.max(
+					250,
+					Math.min(PRELOAD_TIMEOUT_MS, dwellMs - PRELOAD_HEADROOM_MS)
+				);
+				timer = setTimeout(() => done(() => commit(candidates[i])), preloadBudget);
 			const pre = new Image();
 			pre.src = candidates[i];
 			pre.decode().then(
@@ -414,7 +437,9 @@
 			return;
 		}
 		showBottomNav.set(false);
-		void acquireWakeLock();
+		void acquireWakeLock().then((supported) => {
+			wakeLockUnsupported = !supported;
+		});
 		document.addEventListener('fullscreenchange', handleFullscreenChange);
 		showControls(); // show briefly on entry, then fade after the idle timeout
 		unsubs.push(onSseEvent('upload-processed', handleUploadProcessed));
@@ -481,6 +506,20 @@
 		<div class="text-white/60">Lade…</div>
 	{/if}
 
+	<!-- The one thing the operator must know before walking away. This browser cannot hold a
+	     screen wake lock at all, so the OS will dim or lock the display on its own schedule and
+	     somebody will have to walk over and tap it. Placed bottom-left, out of the controls'
+	     corner, and deliberately not auto-hidden with them — it is setup information, and it is
+	     only ever shown when it is actionable. -->
+	{#if wakeLockUnsupported}
+		<div
+			class="pointer-events-none absolute bottom-4 left-4 max-w-xs rounded-md bg-black/60 px-3 py-2 text-left text-xs text-white/70 backdrop-blur"
+		>
+			Dieser Browser kann den Bildschirm nicht wachhalten. Bitte die automatische
+			Bildschirmsperre am Gerät deaktivieren.
+		</div>
+	{/if}
+
 	<!-- Controls appear on pointer/keyboard activity and fade when idle. Still fully
 	     keyboard-reachable (any key reveals them), so the show is never a trap. Notch-safe. -->
 	<div