test(e2e): make nine red specs assert the contracts the code actually implements

The e2e suite had never been run during this audit. It failed 9 of 256; seven of those
predated the audit's changes, established by building a stack from a clean HEAD worktree
and running the same specs against it rather than guessing.

Most were stale assertions rather than product defects:

- quota.spec solved for a target limit using the observed uploader count, but the divisor is
  max(active, estimated_guest_count, 1) and that config seeds at 100 — so every limit it
  aimed for came out 100x small and every "within quota" upload 413'd.
- rate-limit-shared-nat destructured `ticket` from a 429 body and fetched with
  `ticket=undefined`, turning the 429 under test into an unrelated 401. It also faked a
  release with no archive on disk, so the mint's pre-check 404'd and the per-day limiter was
  never reached; it now does a real release and asserts 200 rather than "not 429".
- ddos allowed only [200,429] from ten concurrent streams, so it failed on the very defence
  it exercises: four tickets per session survive and the rest correctly 401. Now asserts
  exactly four, which a tightened cap or an inverted eviction order would catch.
- auth-tampering asserted a throttled IP is refused EVEN with the correct password. That
  contract was deliberately removed — it let any phone on the venue NAT lock the operator
  out of their own admin panel, with a circular escape hatch. Inverted, plus a new check
  that a success does not refill an attacker's bucket.
- moderation-ui assumed a ban leaves a comment "stuck on screen"; `list_for_upload` filters
  banned authors, so it is hidden from everyone including the host. Now pins the pair that
  matters — the ban hides it, and the host's permanent removal survives an unban — and the
  UI leg it used to own is restored as a separate test on a reachable comment.

The export specs mint with `?kind=` now that a download ticket is bound to one archive, and
four of them assert the mint's 404 rather than the download's: with the kind always known,
the pre-check refuses up front instead of after charging a daily download for an archive
that cannot be served.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

e2e/eslint.config.js

@@ -42,6 +42,21 @@ export default ts.config(
     },
   },
   {
-    ignores: ['node_modules/', 'playwright-report/', 'test-results/', '*.config.js'],
+    ignores: [
+      'node_modules/',
+      'playwright-report/',
+      'test-results/',
+      '*.config.js',
+      // Standalone dev/load-test scripts, run directly with `node`. They are not part of the
+      // Playwright tsconfig project, so `projectService: true` cannot type them and every one of
+      // them failed with "was not found by the project service" — which meant `npm run lint` had
+      // been exiting non-zero on main, i.e. the e2e lint gate was not gating at all.
+      //
+      // Ignoring is the honest fix rather than widening the tsconfig: these are throwaway harness
+      // scripts, and the type-aware rules that justify the project service (no-floating-promises)
+      // exist to protect TEST code.
+      '*.mjs',
+      'loadtest/',
+    ],
   }
 );