fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/auth.ts

@@ -15,9 +15,19 @@ export const isAuthenticated = writable(false);
  */
 export const currentPin = writable<string | null>(null);
 
-export function getToken(): string | null {
+// Guest auth lives in localStorage (persists across sessions — a guest returning to the
+// event days later stays signed in). The ADMIN token lives in sessionStorage instead
+// (USER_JOURNEYS §11.1): its tighter 1-day lifetime is meant to bound exposure on a shared
+// "event laptop", and sessionStorage clears on tab/browser close, which localStorage defeats.
+// Reads check sessionStorage FIRST so an active admin token wins over any leftover guest
+// token on the same device.
+function readAuth(key: string): string | null {
 	if (!browser) return null;
-	return localStorage.getItem(TOKEN_KEY);
+	return sessionStorage.getItem(key) ?? localStorage.getItem(key);
+}
+
+export function getToken(): string | null {
+	return readAuth(TOKEN_KEY);
 }
 
 export function getPin(): string | null {
@@ -37,13 +47,11 @@ export function clearPin(): void {
 }
 
 export function getUserId(): string | null {
-	if (!browser) return null;
-	return localStorage.getItem(USER_ID_KEY);
+	return readAuth(USER_ID_KEY);
 }
 
 export function getDisplayName(): string | null {
-	if (!browser) return null;
-	return localStorage.getItem(DISPLAY_NAME_KEY);
+	return readAuth(DISPLAY_NAME_KEY);
 }
 
 export function getExpiry(): Date | null {
@@ -69,6 +77,20 @@ export function setAuth(jwt: string, pin: string | null, userId: string, display
 	isAuthenticated.set(true);
 }
 
+/**
+ * Persist an ADMIN session in sessionStorage (USER_JOURNEYS §11.1) rather than localStorage,
+ * so the elevated credential does not survive a tab/browser close on a shared device — the
+ * point of the tighter 1-day admin token. Admins have no recovery PIN. `getToken` reads
+ * sessionStorage first, so this wins over any leftover guest token on the same device.
+ */
+export function setAdminAuth(jwt: string, userId: string, displayName?: string): void {
+	if (!browser) return;
+	sessionStorage.setItem(TOKEN_KEY, jwt);
+	sessionStorage.setItem(USER_ID_KEY, userId);
+	if (displayName) sessionStorage.setItem(DISPLAY_NAME_KEY, displayName);
+	isAuthenticated.set(true);
+}
+
 // Hook registry: cross-cutting stores (export-status, etc.) register a callback
 // here at import-time so they get reset on every clearAuth path — both the
 // explicit "Event verlassen" button and the api.ts 401 auto-clear. Keeps
@@ -81,11 +103,15 @@ export function onClearAuth(fn: () => void): void {
 
 export function clearAuth(): void {
 	if (!browser) return;
-	localStorage.removeItem(TOKEN_KEY);
-	localStorage.removeItem(USER_ID_KEY);
-	// Clear the display name too — on a shared device the next user shouldn't see
-	// the previous guest's name pre-filled on /join.
-	localStorage.removeItem(DISPLAY_NAME_KEY);
+	// Clear from BOTH stores — a guest token lives in localStorage, an admin token in
+	// sessionStorage; either could be present, and a stale one must not linger.
+	for (const store of [localStorage, sessionStorage]) {
+		store.removeItem(TOKEN_KEY);
+		store.removeItem(USER_ID_KEY);
+		// Clear the display name too — on a shared device the next user shouldn't see
+		// the previous guest's name pre-filled on /join.
+		store.removeItem(DISPLAY_NAME_KEY);
+	}
 	// PIN is intentionally kept so the user can recover
 	isAuthenticated.set(false);
 	// Hooks fire in registration order. Keep them dependency-free of each other —