fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/feed.rs

@@ -181,6 +181,12 @@ pub struct DeltaQuery {
 pub struct DeltaResponse {
     pub uploads: Vec<FeedUpload>,
     pub deleted_ids: Vec<Uuid>,
+    /// Users whose uploads became hidden (banned / uploads_hidden) since `since`. A ban is
+    /// not a soft-delete, so it never appears in `deleted_ids`; without this, a client that
+    /// missed the ephemeral `user-hidden` SSE (a reconnecting projector, most acutely) would
+    /// keep displaying the banned user's already-loaded slides. The client evicts every
+    /// upload from these users on receipt.
+    pub hidden_user_ids: Vec<Uuid>,
     /// True when the upload query hit `DELTA_LIMIT`: the response carries only the
     /// newest slice of the gap, so the client must fall back to a full feed refresh
     /// rather than merging (the older missed uploads are absent and unrecoverable
@@ -229,11 +235,17 @@ pub async fn feed_delta(
     // entire event's uploads in one response. If a client hits the cap it should
     // fall back to a full feed refresh rather than another delta.
     const DELTA_LIMIT: i64 = 200;
+    // `>= since` (not `>`): `created_at` is not unique, so a strict `>` anchored to the exact
+    // timestamp of the last-seen upload silently drops a SECOND upload committed in the same
+    // microsecond — an unrecoverable live-update miss. `>=` re-includes the boundary rows;
+    // the client merges by id (see the feed-delta handler's `seen` set), so the duplicate is
+    // harmless while the tied upload is no longer lost. The cursor still advances to the
+    // response's `server_time`, so this doesn't re-fetch on every subsequent delta.
     let rows = sqlx::query_as::<_, FeedRow>(
         "SELECT id, user_id, uploader_name, preview_path, thumbnail_path,
                 mime_type, caption, like_count, comment_count, created_at
          FROM v_feed
-         WHERE event_id = $1 AND created_at > $2
+         WHERE event_id = $1 AND created_at >= $2
          ORDER BY created_at DESC, id DESC
          LIMIT $3",
     )
@@ -247,9 +259,23 @@ pub async fn feed_delta(
     // client to full-refresh instead of merging a partial delta.
     let truncated = rows.len() as i64 >= DELTA_LIMIT;
 
+    // `>=` for the same tie-break reason as the uploads query above; re-signalling an
+    // already-removed id is idempotent on the client (it filters its list by these ids).
     let deleted_ids: Vec<(Uuid,)> = sqlx::query_as(
         "SELECT id FROM upload
-         WHERE event_id = $1 AND deleted_at IS NOT NULL AND deleted_at > $2",
+         WHERE event_id = $1 AND deleted_at IS NOT NULL AND deleted_at >= $2",
+    )
+    .bind(auth.event_id)
+    .bind(q.since)
+    .fetch_all(&state.pool)
+    .await?;
+
+    // Users hidden since the cursor (ban / uploads_hidden). Uncapped like `deleted_ids` and
+    // for the same reason — an eviction the client misses is unrecoverable via a later delta.
+    let hidden_user_ids: Vec<(Uuid,)> = sqlx::query_as(
+        "SELECT id FROM \"user\"
+         WHERE event_id = $1 AND uploads_hidden = TRUE
+           AND uploads_hidden_at IS NOT NULL AND uploads_hidden_at >= $2",
     )
     .bind(auth.event_id)
     .bind(q.since)
@@ -285,6 +311,7 @@ pub async fn feed_delta(
     Ok(Json(DeltaResponse {
         uploads,
         deleted_ids: deleted_ids.into_iter().map(|r| r.0).collect(),
+        hidden_user_ids: hidden_user_ids.into_iter().map(|r| r.0).collect(),
         truncated,
         server_time,
     }))