fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/admin.rs

@@ -298,12 +298,42 @@ pub async fn download_zip(
         ));
     }
 
-    let path = state.config.export_path.join("Gallery.zip");
+    let path = resolve_export_file(&state, "zip").await?;
+    serve_file(path, "Gallery.zip", "application/zip").await
+}
+
+/// Resolve the on-disk path of the CURRENT export generation from `export_job.file_path`
+/// rather than a fixed filename. Exports are written to per-generation paths
+/// (`Gallery.<seq>.zip`) so a superseded worker can't stomp a fresh keepsake (H1); the
+/// download must therefore follow whatever the current 'done' row points at, not guess.
+async fn resolve_export_file(
+    state: &AppState,
+    export_type: &str,
+) -> Result<std::path::PathBuf, AppError> {
+    let file_path: Option<(Option<String>,)> = sqlx::query_as(
+        "SELECT file_path FROM export_job ej
+         JOIN event e ON e.id = ej.event_id
+         WHERE e.slug = $1 AND ej.type = $2::export_type AND ej.status = 'done'",
+    )
+    .bind(&state.config.event_slug)
+    .bind(export_type)
+    .fetch_optional(&state.pool)
+    .await
+    .map_err(|e| AppError::Internal(e.into()))?;
+
+    // `file_path` is stored as `exports/<name>`; the base dir is already `export_path`, so
+    // join only the file name (defends against any absolute/`..` content too).
+    let rel = file_path
+        .and_then(|(p,)| p)
+        .ok_or_else(|| AppError::NotFound("Exportdatei nicht gefunden.".into()))?;
+    let name = std::path::Path::new(&rel)
+        .file_name()
+        .ok_or_else(|| AppError::NotFound("Exportdatei nicht gefunden.".into()))?;
+    let path = state.config.export_path.join(name);
     if !path.exists() {
         return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
     }
-
-    serve_file(path, "Gallery.zip", "application/zip").await
+    Ok(path)
 }
 
 pub async fn download_html(
@@ -324,11 +354,7 @@ pub async fn download_html(
         ));
     }
 
-    let path = state.config.export_path.join("Memories.zip");
-    if !path.exists() {
-        return Err(AppError::NotFound("Exportdatei nicht gefunden.".into()));
-    }
-
+    let path = resolve_export_file(&state, "html").await?;
     serve_file(path, "Memories.zip", "application/zip").await
 }