test+docs: tighten H1 assertions, cover secret/XFF edges, document boot & SSE-ban

Re-review follow-ups (non-blocking quality items):

Tests:
- moderation H1 specs now assert exact `→ 403` instead of bare .rejects.toThrow(),
  so a spurious 500 can no longer masquerade as "revocation worked".
- config: added case-insensitivity (upper/mixed-case placeholder) and the
  len==32/31 boundary cases for validate_secrets.
- rate_limiter: added the trailing-comma empty-entry case for client_ip (must
  fall back, not return "").
  (Backend unit tests: 35 pass.)

Docs:
- README: note that with APP_ENV=production a placeholder .env makes the app
  refuse to boot and Caddy wait unhealthy — reason is in `docker compose logs app`.
- SECURITY-BACKLOG + sse.rs comment: document that a mid-session ban does not
  tear down an already-open SSE stream (new tickets are blocked; low blast radius).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/moderation.spec.ts

@@ -71,8 +71,10 @@ test.describe('Host — live role/ban revocation (H1)', () => {
     // Demote via admin — the host does NOT re-login.
     await api.setRole(adminToken, u.userId, 'guest');
 
-    // Same token is now rejected because the middleware trusts the DB role.
-    await expect(api.listUsers(hostJwt)).rejects.toThrow();
+    // Same token is now rejected with exactly 403 (RequireHost sees the DB role,
+    // not the JWT claim). Asserting the status guards against a spurious 500
+    // masquerading as "revoked".
+    await expect(api.listUsers(hostJwt)).rejects.toThrow(/→ 403/);
   });
 
   test('a banned host is locked out immediately on their existing session', async ({
@@ -85,14 +87,14 @@ test.describe('Host — live role/ban revocation (H1)', () => {
 
     await api.banUser(adminToken, host.userId, false);
 
-    // Banned users are rejected by the auth extractor before any handler runs.
-    await expect(api.listUsers(host.jwt)).rejects.toThrow();
+    // Banned users are rejected with 403 by the auth extractor before any handler runs.
+    await expect(api.listUsers(host.jwt)).rejects.toThrow(/→ 403/);
   });
 
   test('a banned host cannot unban themselves', async ({ api, adminToken, host }) => {
     await api.banUser(adminToken, host.userId, false);
     await expect(
       api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })
-    ).rejects.toThrow();
+    ).rejects.toThrow(/→ 403/);
   });
 });