fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/sse.ts

@@ -12,7 +12,7 @@
 //   delta into its in-memory list.
 
 import { getToken } from './auth';
-import { api } from './api';
+import { api, ApiError } from './api';
 import type { DeltaResponse } from './types';
 
 type StreamTicketResponse = { ticket: string; server_time: string };
@@ -45,7 +45,9 @@ const KNOWN_EVENTS = [
 	'event-updated',
 	'export-progress',
 	'export-available',
-	'pin-reset'
+	'pin-reset',
+	// A guest asked a host to reset their PIN — hosts refresh their pending-request badge.
+	'pin-reset-requested'
 ] as const;
 
 /**
@@ -197,7 +199,7 @@ function extractCreatedAt(data: string): string | undefined {
  * in-memory list. Swallows errors — a failed delta is non-fatal; the next live
  * SSE event will keep the feed moving.
  */
-async function deltaFetchAndFan(since: string): Promise<void> {
+async function deltaFetchAndFan(since: string, attempt = 0): Promise<void> {
 	try {
 		const response = await api.get<DeltaResponse>(
 			`/feed/delta?since=${encodeURIComponent(since)}`
@@ -206,11 +208,24 @@ async function deltaFetchAndFan(since: string): Promise<void> {
 		// reconnect resumes exactly where the server left off (no browser-clock skew).
 		lastEventTime = response.server_time;
 		dispatch('feed-delta', JSON.stringify(response));
-	} catch {
-		// non-fatal
+	} catch (e) {
+		// A throttled delta (429) must NOT be silently dropped: live events keep advancing
+		// `lastEventTime`, so the next reconnect would resume PAST this un-fetched gap and
+		// lose it. Retry the SAME `since` with backoff so the gap [since, now] is still
+		// covered regardless of how the live cursor moves in the meantime. Bounded, and only
+		// reachable by a rapidly flapping EventSource hitting the per-user delta limit.
+		if (e instanceof ApiError && e.status === 429 && attempt < MAX_DELTA_RETRIES) {
+			const delayMs = DELTA_RETRY_BASE_MS * 2 ** attempt;
+			setTimeout(() => void deltaFetchAndFan(since, attempt + 1), delayMs);
+		}
+		// Other errors are non-fatal — the next live SSE event keeps the feed moving.
 	}
 }
 
+/** Bounded backoff for a rate-limited reconnect delta (see `deltaFetchAndFan`). */
+const MAX_DELTA_RETRIES = 4;
+const DELTA_RETRY_BASE_MS = 2000;
+
 // Page Visibility API: close while hidden, reopen on focus. On reopen `connectSse`'s
 // `onopen` runs the delta fetch.
 function handleVisibilityChange() {