feat(host): warn about low disk before it becomes unrecoverable

Storage visibility existed in exactly one place: a passive Speicherauslastung widget
on the ADMIN dashboard. A host who isn't the admin had no view of it, and nothing
warned anyone. README carried "Low-disk alert (< 10 GB free)" under Planned since v1.

Two things make this a safety net rather than a nice-to-have. postgres_data,
media_data and exports_data are all Docker named volumes on ONE filesystem, so
running out doesn't degrade a subsystem -- Postgres stops being able to write and the
whole event goes down. And the keepsake needs room for two gallery-sized archives,
which the export preflight can only ever refuse AFTER the release, when the event is
over and every remedy is harder.

So the threshold is not a fixed number alone. It fires on the 10 GB floor the README
always named, OR on "you could not build the keepsake right now" -- the trigger a
host can still act on, computed with the same arithmetic the preflight uses. Unknown
free space is NOT low: it fails open like the upload quota and the preflight do,
because a banner that cries wolf on an unreadable mount is a banner nobody reads.

Carried on GET /host/event, which the dashboard already fetches on load and on every
reload -- no new endpoint, no new poll. Rendered above everything else including the
PIN-reset queue, and it names the consequence (the event, not just the download)
rather than only the number.

Also fixes the host page's formatBytes, which topped out at MB: 30 GB free would have
rendered as "30720.0 MB", and a guest with 2 GB of uploads was already being shown
that way in the user list.

Tests: 5 unit on the threshold (including that plenty of free space is still low when
the keepsake wouldn't fit -- the case a fixed threshold misses entirely), 3 e2e.
The e2e drives it through `original_size_bytes` rather than a genuinely full disk:
the estimate is pure SQL over that column, so overstating one row moves the
accounting without touching a byte on disk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/src/handlers/host.rs

@@ -35,6 +35,32 @@ pub struct EventStatus {
     pub is_active: bool,
     pub uploads_locked: bool,
     pub export_released: bool,
+    /// Free space on the volume the keepsake is written to. `None` when the mount can't be
+    /// resolved — the UI hides the widget rather than rendering a confident zero.
+    pub disk_free_bytes: Option<u64>,
+    /// What a full keepsake build would need right now (both halves).
+    pub keepsake_required_bytes: u64,
+    /// Whether the host should be warned. See [`disk_is_low`].
+    pub disk_low: bool,
+}
+
+/// Absolute floor below which free space is worth surfacing regardless of gallery size — the
+/// threshold the README has carried on the roadmap since v1.
+const LOW_DISK_FLOOR_BYTES: u64 = 10_000_000_000;
+
+/// Is free space low enough that the host needs to know?
+///
+/// Two triggers, because a fixed threshold answers the wrong question. `postgres_data`,
+/// `media_data` and `exports_data` are all Docker named volumes on one filesystem, so a full disk
+/// does not degrade one subsystem — it stops Postgres writing and takes the event down. That is
+/// what the absolute floor is for.
+///
+/// The second trigger is the one that actually earns its place: the keepsake needs room for two
+/// gallery-sized archives, and the only moment a host can do anything about that is BEFORE they
+/// release. Warning at "you could not build the keepsake right now" turns a post-event dead end
+/// into a decision someone can still make.
+fn disk_is_low(free: u64, keepsake_required: u64) -> bool {
+    free < LOW_DISK_FLOOR_BYTES || free < keepsake_required
 }
 
 /// Count non-banned hosts/admins in the event OTHER than `excluding` — the operators
@@ -72,11 +98,29 @@ pub async fn get_event_status(
         .await?
         .ok_or_else(|| AppError::NotFound("Event nicht gefunden.".into()))?;
 
+    // Measured on the EXPORT volume, not the media one: that is where the cliff is, and it is a
+    // distinct mount point even when both are backed by the same filesystem. The cached reading is
+    // right here — this is advisory, polled on every dashboard load, and a 15s-stale number costs
+    // nothing (unlike the export preflight, which reads uncached because it is about to write).
+    let free = state
+        .disk_cache
+        .snapshot(&state.config.export_path)
+        .map(|d| d.free);
+    let keepsake_required_bytes =
+        crate::services::export::keepsake_space_required(&state.pool, event.id)
+            .await
+            .unwrap_or(0);
+
     Ok(Json(EventStatus {
         name: event.name,
         is_active: event.is_active,
         uploads_locked: event.uploads_locked_at.is_some(),
         export_released: event.export_released_at.is_some(),
+        disk_free_bytes: free,
+        keepsake_required_bytes,
+        // Unknown free space is NOT low. Fails open, exactly as the upload quota and the export
+        // preflight do: a scary banner on an unreadable mount would train the host to ignore it.
+        disk_low: free.is_some_and(|f| disk_is_low(f, keepsake_required_bytes)),
     }))
 }
 
@@ -765,3 +809,45 @@ pub async fn release_gallery(
 
     Ok(StatusCode::NO_CONTENT)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{LOW_DISK_FLOOR_BYTES, disk_is_low};
+
+    const GB: u64 = 1_000_000_000;
+
+    #[test]
+    fn a_healthy_disk_with_room_for_the_keepsake_is_not_low() {
+        assert!(!disk_is_low(40 * GB, 25 * GB));
+    }
+
+    #[test]
+    fn the_absolute_floor_fires_even_when_the_gallery_is_tiny() {
+        // All three volumes share one filesystem, so running out doesn't degrade one subsystem —
+        // Postgres stops being able to write and the event goes down. A 1 GB gallery would clear
+        // the keepsake test comfortably; the floor is what catches this.
+        assert!(disk_is_low(5 * GB, GB));
+        assert!(disk_is_low(LOW_DISK_FLOOR_BYTES - 1, 0));
+        assert!(!disk_is_low(LOW_DISK_FLOOR_BYTES, 0));
+    }
+
+    #[test]
+    fn plenty_of_space_is_still_low_when_the_keepsake_would_not_fit() {
+        // THE case the fixed threshold misses, and the one that matters: 30 GB free is nowhere near
+        // any floor, but a 30 GB gallery needs room for TWO archives. The host can act on this
+        // before releasing; after releasing, they cannot.
+        assert!(disk_is_low(30 * GB, 66 * GB));
+    }
+
+    #[test]
+    fn the_keepsake_trigger_is_exact_at_the_boundary() {
+        assert!(!disk_is_low(66 * GB, 66 * GB), "exactly enough is enough");
+        assert!(disk_is_low(66 * GB - 1, 66 * GB));
+    }
+
+    #[test]
+    fn an_empty_gallery_needs_nothing_and_only_the_floor_applies() {
+        assert!(!disk_is_low(11 * GB, 0));
+        assert!(disk_is_low(9 * GB, 0));
+    }
+}