fix(ui): make the dashboards agree with each other and with what the code does

Host and admin implement the same four operations with independently written copy, and
admin was stale or wrong in every case. Its release button was always enabled and always
read "Galerie freigeben", so a second tap returned a 409; it showed no release state, no
keepsake progress, no failure reason, no rebuild, and never refreshed after releasing.
It now matches the host page.

Both dashboards subscribed to SSE and never opened the connection — `onSseEvent` only
registers a handler. Every subscription was inert, so the keepsake progress bar sat
frozen after a release and PIN requests appeared only on a manual refresh. It happened
to work when arriving straight from /feed, which connects, and /feed disconnects on
destroy, so navigating to the dashboard killed it again.

The unban confirm named neither of the two things a host most needs to know: unbanning
also restores ALL of that guest's previously hidden photos to the gallery, diashow and
export, and it retires and rebuilds a released keepsake, during which every guest's
download is briefly unavailable. The ban modal warns that uploads vanish; nothing said
they come back. Both now do, gated on the gallery actually being released.

"Event verlassen" implied the account was being deleted, then the dialog said the guest
could log back in. It calls `DELETE /session` — this device only, nothing deleted — so
it is "Abmelden" now. Gallery release now states it locks uploads and is reversible; PIN
reset states the guest is signed out on all devices.

The keepsake download failed silently: nothing inspected the iframe result and the
ticket POST always succeeded, so an over-limit tap did nothing at all. It now surfaces
the (newly visible) 429 and confirms the download started. `/export` rendered "Export
noch nicht verfügbar / Schau nach der Veranstaltung noch einmal vorbei" when the status
request had merely FAILED — telling a guest to come back after an event that already
happened. Both dashboards' error states gained a retry, which a host on a PWA with no
URL bar otherwise has no way to reach.

Modals were centred with no max-height, so on a short viewport the join PIN dialog
clipped equally top and bottom — potentially putting "Weiter zur Galerie" off-screen at
the moment a first-time guest must proceed. The ten moderation buttons were ~28px tall
side by side, on the screen where a mis-tap bans the wrong guest; they are 44px now.
Six German quotation marks paired the opening „ with an ASCII straight quote.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/routes/account/+page.svelte

@@ -537,9 +537,12 @@
 						d="M15.75 9V5.25A2.25 2.25 0 0013.5 3h-6a2.25 2.25 0 00-2.25 2.25v13.5A2.25 2.25 0 007.5 21h6a2.25 2.25 0 002.25-2.25V15m3 0l3-3m0 0l-3-3m3 3H9"
 					/>
 				</svg>
-				<span class="flex-1 text-sm font-medium text-red-600 dark:text-red-400"
-					>Event verlassen</span
-				>
+				<!-- "Abmelden", not "Event verlassen". The action is `DELETE /session` — it revokes
+				     THIS device's session and clears the local token. Nothing is deleted: the
+				     account, the PIN and every uploaded photo stay, and the guest returns with
+				     their PIN. "Event verlassen" read as leaving for good / being removed, which
+				     the confirm sheet then contradicted by saying you can come back. -->
+				<span class="flex-1 text-sm font-medium text-red-600 dark:text-red-400">Abmelden</span>
 			</button>
 
 			<!-- Sign out everywhere (all devices) -->
@@ -612,10 +615,10 @@
 <!-- Leave-confirm bottom sheet -->
 <ConfirmSheet
 	open={leaveConfirmOpen}
-	title={leaveEverywhere ? 'Auf allen Geräten abmelden?' : 'Event verlassen?'}
+	title={leaveEverywhere ? 'Auf allen Geräten abmelden?' : 'Abmelden?'}
 	message={leaveEverywhere
-		? 'Alle deine Sitzungen (auch auf anderen Geräten) werden beendet. Mit deinem PIN kannst du jederzeit zurückkehren.'
-		: 'Du wirst abgemeldet. Mit deinem PIN kannst du jederzeit zurückkehren.'}
+		? 'Alle deine Sitzungen (auch auf anderen Geräten) werden beendet. Deine Fotos bleiben erhalten — mit deinem Namen und PIN kannst du dich jederzeit wieder anmelden.'
+		: 'Du wirst nur auf diesem Gerät abgemeldet. Deine Fotos bleiben erhalten — mit deinem Namen und PIN kannst du dich jederzeit wieder anmelden.'}
 	confirmLabel="Abmelden"
 	tone="danger"
 	onConfirm={() => handleLogout(leaveEverywhere)}