fix(user-flow): persona-audit fixes — ban replay, locked-upload data loss, host UX, admin session

Follows the perf + security + user-flow work with a role/persona audit (guest, host,
admin, projector) and fixes across three review rounds. Highlights:

HIGH
- Ban now replays on reconnect. A ban isn't a soft-delete, and the `user-hidden` SSE has
  no replay, so a client that missed it (esp. the unattended diashow) kept cycling a
  banned user's slides. New `uploads_hidden_at` (migration 013) + `hidden_user_ids` in
  /feed/delta; feed + diashow evict those users. Applied even on a truncated delta.

MEDIUM
- Locked-upload data loss: a photo staged offline during a lock/release was purged as a
  terminal 4xx and lost when the host reopened. New reversible `uploads_locked` error code;
  the queue keeps the blob and auto-resumes on the `event-opened` SSE.
- Reopen after release now warns (ConfirmSheet) that it revokes the published keepsake.
- Host "forgotten-PIN" badge updates live (`pin-reset-requested` was broadcast but never
  in KNOWN_EVENTS / subscribed); host page also refetches on `pin-reset` so a two-host
  race can't hand out a conflicting PIN.
- Ban modal copy fixed (read-only ban, not "session ended"); Degradieren/Sperren/Entsperren
  hidden on peer-host rows for non-admins (they always 403'd).
- Host dashboard shows live keepsake generation progress / ready state + link to /export.
- Admin JWT moved to sessionStorage (§11.1) to bound exposure on shared devices.

Export generation guard (H1 from the prior round, hardened): per-(event,type) `release_seq`
(migration 012) with seq-guarded claim/finalize/mark_failed/update_progress, per-generation
temp/final paths, download follows `file_path`, prune only strictly-older generations.

LOW: diashow coalesces upload-processed (avoids self-rate-limit); event-closed reconciles
galleryReleased; /recover gains a forgot-PIN request + drops a stale cached PIN on 401;
delta `>=` tie-break + 429 retry; misc copy/labels.

Adds e2e: ban-replay, upload-lock-code, and rewrites export-reopen-rerelease with a
data-completeness test. Reconciles USER_JOURNEYS §9/§11.

Verified: cargo build clean, 40 unit tests, svelte-check 0 errors, 33 frontend unit
tests, 155 e2e passing on chromium-desktop.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/routes/recover/+page.svelte

@@ -1,7 +1,7 @@
 <script lang="ts">
 	import { goto, afterNavigate } from '$app/navigation';
 	import { api, ApiError } from '$lib/api';
-	import { setAuth, getPin, getToken } from '$lib/auth';
+	import { setAuth, getPin, getToken, clearPin } from '$lib/auth';
 	import { browser } from '$app/environment';
 	import IconButton from '$lib/components/IconButton.svelte';
 
@@ -28,6 +28,26 @@
 	let pin = $state('');
 	let error = $state('');
 	let loading = $state(false);
+	let pinRequestLoading = $state(false);
+	let pinRequestSent = $state(false);
+
+	// Forgot the PIN entirely (never noted it, or a host reset it): ask a host to reset it.
+	// The endpoint always 204s (no name enumeration), so optimistically confirm regardless.
+	async function requestPinReset() {
+		if (!displayName.trim()) {
+			error = 'Bitte gib zuerst deinen Namen ein.';
+			return;
+		}
+		pinRequestLoading = true;
+		try {
+			await api.post('/recover/request', { display_name: displayName.trim() });
+		} catch {
+			// Non-fatal (rate limit etc.) — still confirm so the user isn't stuck.
+		} finally {
+			pinRequestLoading = false;
+			pinRequestSent = true;
+		}
+	}
 
 	// Pre-fill PIN from localStorage if available
 	if (browser) {
@@ -53,6 +73,10 @@
 		} catch (e) {
 			if (e instanceof ApiError) {
 				error = e.message;
+				// A wrong PIN here often means the locally-cached PIN is stale (a host reset it
+				// while this device was offline and missed the `pin-reset` SSE). Drop the cached
+				// value so it doesn't keep pre-filling the field with the dead PIN.
+				if (e.status === 401) clearPin();
 			} else {
 				error = 'Ein Fehler ist aufgetreten.';
 			}
@@ -124,6 +148,24 @@
 			</button>
 		</form>
 
+		<!-- PIN lost entirely (never noted, or reset by a host while offline): a soft dead-end
+		     without this — offer the host-reset request path. -->
+		{#if pinRequestSent}
+			<p class="mt-4 text-center text-sm text-green-700 dark:text-green-400" data-testid="recover-pin-request-sent">
+				Anfrage gesendet. Bitte einen Host, deine PIN zurückzusetzen — komm danach mit der neuen PIN zurück.
+			</p>
+		{:else}
+			<button
+				type="button"
+				onclick={requestPinReset}
+				disabled={pinRequestLoading}
+				data-testid="recover-request-pin-reset"
+				class="mt-4 w-full text-center text-sm text-blue-600 underline disabled:opacity-50 dark:text-blue-400"
+			>
+				{pinRequestLoading ? 'Wird gesendet…' : 'PIN vergessen? Host um Zurücksetzen bitten'}
+			</button>
+		{/if}
+
 		<p class="mt-4 text-center text-sm text-gray-500 dark:text-gray-400">
 			Noch kein Konto?
 			<a href="/join" class="text-blue-600 hover:underline dark:text-blue-400">Neu beitreten</a>