backend(features): quota enforcement, PIN reset, /me, original download, toggles

- handlers/me.rs (new): GET /api/v1/me/context (profile + role + privacy_note
  + quota toggle state, fetched once on app bootstrap) and GET /api/v1/me/quota
  (live used / limit / active uploaders / free disk).
- handlers/upload.rs:
  - quota enforcement via the dynamic formula
    floor((free_disk * tolerance) / max(active_uploaders, 1)),
    gated by quota_enabled + storage_quota_enabled toggles
  - new GET /api/v1/upload/{id}/original — unauthed by design
    (matches /media/previews/* — URL is the secret) so it works as
    <img src> / <video src> / window.open
  - rate-limit toggle wiring (rate_limits_enabled + upload_rate_enabled)
- handlers/host.rs:
  - POST /api/v1/host/users/{id}/pin-reset — Host may reset guest PINs,
    Admin may reset guest + host PINs (never another admin or self).
    Returns the freshly-generated plaintext PIN once; emits a global
    pin-reset SSE so the affected user's device can clear its localStorage.
  - set_role guard expanded so hosts can demote other hosts (not self,
    never admins) — backend match for the doc'd permission model.
- handlers/admin.rs: ALLOWED_KEYS split into NUMERIC_KEYS / BOOL_KEYS /
  TEXT_KEYS with per-kind validation; saving privacy_note broadcasts an
  event-updated SSE so other clients refresh live.
- handlers/feed.rs, handlers/admin.rs (export), auth/handlers.rs:
  rate-limit toggle wiring at every limiter call site.
- auth/handlers.rs: when an expired PIN lockout is detected on /recover,
  reset failed_pin_attempts to zero before the bcrypt check — without
  this every wrong PIN re-locked the user after the cooldown.
- main.rs: wire startup_recovery + spawn_periodic_tasks, register the
  new /me/context, /me/quota, /upload/{id}/original, and
  /host/users/{id}/pin-reset routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/auth/handlers.rs

@@ -14,6 +14,7 @@ use crate::error::AppError;
 use crate::models::event::Event;
 use crate::models::session::Session;
 use crate::models::user::{User, UserRole};
+use crate::services::config;
 use crate::services::rate_limiter::client_ip;
 use crate::state::AppState;
 
@@ -36,7 +37,11 @@ pub async fn join(
     Json(body): Json<JoinRequest>,
 ) -> Result<(StatusCode, Json<JoinResponse>), AppError> {
     let ip = client_ip(&headers, "unknown");
-    if !state.rate_limiter.check(format!("join:{ip}"), 5, Duration::from_secs(60)) {
+    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
+    let join_rate_on = config::get_bool(&state.pool, "join_rate_enabled", true).await;
+    if rate_limits_on && join_rate_on
+        && !state.rate_limiter.check(format!("join:{ip}"), 5, Duration::from_secs(60))
+    {
         return Err(AppError::TooManyRequests(
             "Zu viele Anfragen. Bitte warte kurz und versuche es erneut.".into(),
             None,
@@ -128,7 +133,11 @@ pub async fn recover(
     }
 
     for user in &users {
-        // Check PIN lockout
+        // Check PIN lockout. If the lockout has expired, also reset the failed-attempt
+        // counter so the user gets a fresh 3-strike window — otherwise the counter
+        // stays at 3+ and every subsequent wrong PIN immediately re-locks them, even
+        // after waiting out the cooldown. Without this reset, a once-locked account
+        // is effectively permanently fragile.
         if let Some(locked_until) = user.pin_locked_until {
             if Utc::now() < locked_until {
                 return Err(AppError::TooManyRequests(
@@ -136,6 +145,8 @@ pub async fn recover(
                     None,
                 ));
             }
+            // Lockout window expired — wipe the counter and the timestamp.
+            User::reset_pin_attempts(&state.pool, user.id).await?;
         }
 
         let pin_matches = bcrypt::verify(&body.pin, &user.recovery_pin_hash)