test+docs: tighten H1 assertions, cover secret/XFF edges, document boot & SSE-ban

Re-review follow-ups (non-blocking quality items):

Tests:
- moderation H1 specs now assert exact `→ 403` instead of bare .rejects.toThrow(),
  so a spurious 500 can no longer masquerade as "revocation worked".
- config: added case-insensitivity (upper/mixed-case placeholder) and the
  len==32/31 boundary cases for validate_secrets.
- rate_limiter: added the trailing-comma empty-entry case for client_ip (must
  fall back, not return "").
  (Backend unit tests: 35 pass.)

Docs:
- README: note that with APP_ENV=production a placeholder .env makes the app
  refuse to boot and Caddy wait unhealthy — reason is in `docker compose logs app`.
- SECURITY-BACKLOG + sse.rs comment: document that a mid-session ban does not
  tear down an already-open SSE stream (new tickets are blocked; low blast radius).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/config.rs

@@ -135,4 +135,23 @@ mod tests {
     fn non_prod_still_rejects_short_non_sentinel_secret() {
         assert!(validate_secrets(false, "tooshort", "").is_err());
     }
+
+    #[test]
+    fn placeholder_detection_is_case_insensitive() {
+        // looks_placeholder lowercases before matching — an upper/mixed-case
+        // placeholder must still be rejected in prod.
+        assert!(validate_secrets(true, "CHANGE_ME_TO_A_RANDOM_64_BYTE_HEX_STRING", REAL_HASH).is_err());
+        assert!(validate_secrets(true, REAL_SECRET, "$2Y$12$PLACEHOLDER_replace_me").is_err());
+    }
+
+    #[test]
+    fn prod_len_boundary_at_32() {
+        // Exactly 32 non-placeholder chars is the minimum accepted; 31 is rejected.
+        const LEN_32: &str = "abcdefghijklmnopqrstuvwxyz012345";
+        const LEN_31: &str = "abcdefghijklmnopqrstuvwxyz01234";
+        assert_eq!(LEN_32.len(), 32);
+        assert_eq!(LEN_31.len(), 31);
+        assert!(validate_secrets(true, LEN_32, REAL_HASH).is_ok());
+        assert!(validate_secrets(true, LEN_31, REAL_HASH).is_err());
+    }
 }

backend/src/handlers/sse.rs

@@ -48,6 +48,10 @@ pub async fn stream(
         .consume(&q.ticket)
         .ok_or_else(|| AppError::Unauthorized("Ticket ungültig oder abgelaufen.".into()))?;
 
+    // NOTE: this authenticates via ticket→session, not the `AuthUser` extractor, so
+    // it does not re-check `is_banned`. A user banned mid-stream keeps receiving
+    // events until the connection drops; they cannot reconnect (issue_ticket uses
+    // AuthUser, which rejects banned users). Documented in docs/SECURITY-BACKLOG.md.
     Session::find_by_token_hash(&state.pool, &token_hash)
         .await
         .map_err(|e| AppError::Internal(e.into()))?

backend/src/services/rate_limiter.rs

@@ -167,4 +167,14 @@ mod tests {
     fn client_ip_falls_back_when_header_absent() {
         assert_eq!(client_ip(&HeaderMap::new(), "127.0.0.1"), "127.0.0.1");
     }
+
+    #[test]
+    fn client_ip_falls_back_on_trailing_comma_empty_entry() {
+        // A trailing comma leaves an empty right-most segment after trimming; the
+        // `.filter(!is_empty)` must reject it and fall through to the fallback
+        // rather than returning "" (which would collapse callers into one bucket).
+        let mut h = HeaderMap::new();
+        h.insert("x-forwarded-for", "203.0.113.7, ".parse().unwrap());
+        assert_eq!(client_ip(&h, "127.0.0.1"), "127.0.0.1");
+    }
 }