fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/host.rs

@@ -149,7 +149,9 @@ pub async fn ban_user(
     // contradict that model, break the documented "banned guest can still download the
     // keepsake" flow, and be ineffective anyway (the user could just /recover a new session).
     sqlx::query(
-        "UPDATE \"user\" SET is_banned = TRUE, uploads_hidden = TRUE WHERE id = $1 AND event_id = $2",
+        "UPDATE \"user\"
+         SET is_banned = TRUE, uploads_hidden = TRUE, uploads_hidden_at = NOW()
+         WHERE id = $1 AND event_id = $2",
     )
     .bind(user_id)
     .bind(auth.event_id)
@@ -201,9 +203,12 @@ pub async fn unban_user(
     }
 
     // Unban restores visibility too: ban set `uploads_hidden = TRUE`, so clearing only
-    // `is_banned` would leave their content invisible. Clear both.
+    // `is_banned` would leave their content invisible. Clear all three (the timestamp too,
+    // so a future ban stamps a fresh `uploads_hidden_at` the reconnect delta will replay).
     let result = sqlx::query(
-        "UPDATE \"user\" SET is_banned = FALSE, uploads_hidden = FALSE WHERE id = $1 AND event_id = $2",
+        "UPDATE \"user\"
+         SET is_banned = FALSE, uploads_hidden = FALSE, uploads_hidden_at = NULL
+         WHERE id = $1 AND event_id = $2",
     )
     .bind(user_id)
     .bind(auth.event_id)
@@ -242,10 +247,11 @@ pub async fn set_role(
         }
     };
 
-    // Look up the current role so we can apply the host-vs-admin guard. Hosts may
-    // promote guests and demote *other* hosts (the user explicitly requested this
-    // expansion). Hosts may not touch admins. Admins may do anything (except change
-    // themselves, blocked above).
+    // Look up the current role so we can apply the host-vs-admin guard. A plain host may
+    // promote/demote GUESTS only; it may not change any host's or admin's role (see the
+    // guard below — this closes the demote-a-peer-host→ban/PIN-reset takeover chain, F1).
+    // Only an admin may change a host's role. Admins may do anything except change
+    // themselves (blocked above).
     let target = sqlx::query_as::<_, (String,)>(
         "SELECT role::text FROM \"user\" WHERE id = $1 AND event_id = $2",
     )
@@ -356,8 +362,13 @@ pub async fn reset_user_pin(
     .await?;
 
     // A PIN reset means the old credential is compromised/forgotten — revoke every
-    // existing session so old devices must re-authenticate with the new PIN.
-    let _ = Session::delete_all_for_user(&state.pool, user_id).await;
+    // existing session so old devices must re-authenticate with the new PIN. This is a
+    // security-relevant revoke: if it fails, the old sessions stay valid (sessions are
+    // token- not PIN-bound), so surface the error in logs rather than swallowing it
+    // silently while reporting success to the host.
+    if let Err(e) = Session::delete_all_for_user(&state.pool, user_id).await {
+        tracing::error!(error = ?e, user_id = %user_id, "PIN reset: failed to revoke sessions");
+    }
 
     // Resolve any pending in-app "I forgot my PIN" request for this user.
     let _ = sqlx::query("DELETE FROM pin_reset_request WHERE user_id = $1")