fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/routes/diashow/+page.svelte

@@ -75,18 +75,33 @@
 	// to `new-upload` here — its payload arrives before compression finishes
 	// (preview_url is still null), and `SlideQueue.pushLive` dedupes by id, so the
 	// preview would never be picked up if we enqueued the pre-processed version first.
-	async function handleUploadProcessed(data: string) {
+	// COALESCE the fetch: a host bulk-uploading fires dozens of `upload-processed` events in
+	// seconds; one `/feed` fetch per event trips the per-user feed rate limit (429) and drops
+	// slides. Debounce into a single fetch of the newest slice instead.
+	let processedDebounce: ReturnType<typeof setTimeout> | null = null;
+	function handleUploadProcessed(data: string) {
 		try {
-			const payload = JSON.parse(data) as { upload_id: string };
-			if (!payload.upload_id) return;
-			const feed = await api.get<FeedResponse>('/feed?limit=20');
-			const found = feed.uploads.find((u) => u.id === payload.upload_id);
-			if (found) {
-				queue.pushLive(found);
-				if (!current) advance();
-			}
+			const { upload_id } = JSON.parse(data) as { upload_id: string };
+			if (!upload_id) return;
 		} catch {
-			// ignore — silent recovery; the next event will retry
+			return;
+		}
+		if (processedDebounce) clearTimeout(processedDebounce);
+		processedDebounce = setTimeout(() => {
+			processedDebounce = null;
+			void refreshRecentFromFeed();
+		}, 500);
+	}
+
+	async function refreshRecentFromFeed() {
+		try {
+			const feed = await api.get<FeedResponse>('/feed?limit=50');
+			for (const upload of feed.uploads) {
+				if (upload.preview_url || upload.thumbnail_url) queue.pushLive(upload);
+			}
+			if (!current) advance();
+		} catch {
+			// ignore — silent recovery; the next event or reconnect delta retries
 		}
 	}
 
@@ -107,10 +122,27 @@
 	function handleFeedDelta(data: string) {
 		try {
 			const delta = JSON.parse(data) as DeltaResponse;
+			// Apply deletions + ban-hides FIRST and unconditionally: both are explicit, uncapped
+			// lists, so a moderated/removed photo (or a banned user's whole set) must leave the
+			// rotation even when the delta is truncated. This replays a `user-hidden`/delete the
+			// projector missed while disconnected — the reason a banned guest's slides used to
+			// keep cycling all night. (We can't infer removals by absence from a capped /feed
+			// backfill — older slides beyond the newest 200 would be falsely dropped.)
 			for (const id of delta.deleted_ids) {
 				const result = queue.remove(id, current?.id ?? null);
 				if (result.wasCurrent) advance();
 			}
+			for (const userId of delta.hidden_user_ids) {
+				const result = queue.removeByUser(userId, current?.id ?? null);
+				if (result.wasCurrent) advance();
+			}
+			// A truncated delta's `uploads` is only the newest slice of a larger gap; merging it
+			// alone would skip the older-but-still-new items in between. Backfill new uploads from
+			// a full feed fetch (pushLive dedupes by id, so the current slide isn't disturbed).
+			if (delta.truncated) {
+				void backfillFromFeed();
+				return;
+			}
 			for (const upload of delta.uploads) {
 				// Only enqueue displayable (processed) items; pushLive dedupes by id, so a
 				// later `upload-processed` still refines anything that arrives raw.
@@ -122,6 +154,20 @@
 		}
 	}
 
+	// Full-feed backfill used when a reconnect delta overflows the cap. Merges via
+	// pushLive (id-deduped) so a long-running projector recovers the whole gap.
+	async function backfillFromFeed() {
+		try {
+			const feed = await api.get<FeedResponse>('/feed?limit=200');
+			for (const upload of feed.uploads) {
+				if (upload.preview_url || upload.thumbnail_url) queue.pushLive(upload);
+			}
+			if (!current) advance();
+		} catch {
+			// ignore — the next live event keeps the show moving
+		}
+	}
+
 	function handleUserHidden(data: string) {
 		try {
 			const payload = JSON.parse(data) as { user_id: string };