fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/upload-queue.test.ts

@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest';
+import { classifyUploadStatus } from './upload-queue';
+
+/**
+ * Regression guard for the upload-queue retry policy (H2 + M1). The bug being locked out:
+ * every 4xx except 429 was classified terminal, and a terminal item has its blob PURGED
+ * from IndexedDB. A 401 (a sliding session that lapsed, or a host PIN-reset) is a 4xx, so a
+ * guest's queued photos were irrecoverably destroyed the moment the `online` auto-resume
+ * fired against a dead session. 401 must be `auth` (blob kept, re-auth), NEVER `terminal`.
+ */
+describe('classifyUploadStatus', () => {
+  it('2xx → success', () => {
+    expect(classifyUploadStatus(200)).toBe('success');
+    expect(classifyUploadStatus(201)).toBe('success');
+    expect(classifyUploadStatus(299)).toBe('success');
+  });
+
+  it('401 → auth, NOT terminal (never purge the blob on a dead session)', () => {
+    expect(classifyUploadStatus(401)).toBe('auth');
+  });
+
+  it('429 → rate_limit (back off, auto-resume)', () => {
+    expect(classifyUploadStatus(429)).toBe('rate_limit');
+  });
+
+  it('408 → transient (request timeout is retryable, not terminal)', () => {
+    expect(classifyUploadStatus(408)).toBe('transient');
+  });
+
+  it('genuinely permanent 4xx → terminal (locked / banned / released / quota)', () => {
+    expect(classifyUploadStatus(403)).toBe('terminal'); // banned / locked / released
+    expect(classifyUploadStatus(413)).toBe('terminal'); // quota exhausted
+    expect(classifyUploadStatus(400)).toBe('terminal');
+    expect(classifyUploadStatus(404)).toBe('terminal');
+  });
+
+  it('5xx / unexpected → transient (retryable, blob kept)', () => {
+    expect(classifyUploadStatus(500)).toBe('transient');
+    expect(classifyUploadStatus(502)).toBe('transient');
+    expect(classifyUploadStatus(503)).toBe('transient');
+  });
+});