backend(features): quota enforcement, PIN reset, /me, original download, toggles

- handlers/me.rs (new): GET /api/v1/me/context (profile + role + privacy_note
  + quota toggle state, fetched once on app bootstrap) and GET /api/v1/me/quota
  (live used / limit / active uploaders / free disk).
- handlers/upload.rs:
  - quota enforcement via the dynamic formula
    floor((free_disk * tolerance) / max(active_uploaders, 1)),
    gated by quota_enabled + storage_quota_enabled toggles
  - new GET /api/v1/upload/{id}/original — unauthed by design
    (matches /media/previews/* — URL is the secret) so it works as
    <img src> / <video src> / window.open
  - rate-limit toggle wiring (rate_limits_enabled + upload_rate_enabled)
- handlers/host.rs:
  - POST /api/v1/host/users/{id}/pin-reset — Host may reset guest PINs,
    Admin may reset guest + host PINs (never another admin or self).
    Returns the freshly-generated plaintext PIN once; emits a global
    pin-reset SSE so the affected user's device can clear its localStorage.
  - set_role guard expanded so hosts can demote other hosts (not self,
    never admins) — backend match for the doc'd permission model.
- handlers/admin.rs: ALLOWED_KEYS split into NUMERIC_KEYS / BOOL_KEYS /
  TEXT_KEYS with per-kind validation; saving privacy_note broadcasts an
  event-updated SSE so other clients refresh live.
- handlers/feed.rs, handlers/admin.rs (export), auth/handlers.rs:
  rate-limit toggle wiring at every limiter call site.
- auth/handlers.rs: when an expired PIN lockout is detected on /recover,
  reset failed_pin_attempts to zero before the bcrypt check — without
  this every wrong PIN re-locked the user after the cooldown.
- main.rs: wire startup_recovery + spawn_periodic_tasks, register the
  new /me/context, /me/quota, /upload/{id}/original, and
  /host/users/{id}/pin-reset routes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/main.rs

@@ -31,7 +31,18 @@ async fn main() -> Result<()> {
 
     let config = AppConfig::from_env()?;
     let pool = db::create_pool(&config.database_url).await?;
-    let state = AppState::new(pool, config.clone());
+
+    // Reset any rows left mid-flight by a previous (possibly crashed) instance —
+    // stuck `compression_status='processing'` uploads and `status='running'` export
+    // jobs. Must run before the server starts taking requests so clients never see
+    // the half-state.
+    services::maintenance::startup_recovery(&pool).await;
+
+    let state = AppState::new(pool.clone(), config.clone());
+
+    // Hourly background hygiene: prune expired sessions, evict cold rate-limiter
+    // keys. Keeps the DB and process from growing unboundedly over multi-day events.
+    services::maintenance::spawn_periodic_tasks(pool, state.rate_limiter.clone());
 
     // Ensure media directories exist
     tokio::fs::create_dir_all(&config.media_path).await.ok();
@@ -49,6 +60,13 @@ async fn main() -> Result<()> {
             "/api/v1/upload/{id}",
             patch(handlers::upload::edit_upload).delete(handlers::upload::delete_upload),
         )
+        .route(
+            "/api/v1/upload/{id}/original",
+            get(handlers::upload::get_original),
+        )
+        // Current-user endpoints (live quota estimate, profile + privacy note bundle)
+        .route("/api/v1/me/context", get(handlers::me::get_context))
+        .route("/api/v1/me/quota", get(handlers::me::get_quota))
         // Feed
         .route("/api/v1/feed", get(handlers::feed::feed))
         .route("/api/v1/feed/delta", get(handlers::feed::feed_delta))
@@ -71,6 +89,10 @@ async fn main() -> Result<()> {
         .route("/api/v1/host/users/{id}/ban", post(handlers::host::ban_user))
         .route("/api/v1/host/users/{id}/unban", post(handlers::host::unban_user))
         .route("/api/v1/host/users/{id}/role", patch(handlers::host::set_role))
+        .route(
+            "/api/v1/host/users/{id}/pin-reset",
+            post(handlers::host::reset_user_pin),
+        )
         .route("/api/v1/host/upload/{id}", delete(handlers::host::host_delete_upload))
         .route("/api/v1/host/comment/{id}", delete(handlers::host::host_delete_comment))
         // Export (all authenticated users)