fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/auth/middleware.rs

@@ -37,9 +37,10 @@ impl FromRequestParts<AppState> for AuthUser {
             .strip_prefix("Bearer ")
             .ok_or_else(|| AppError::Unauthorized("Ungültiges Token-Format.".into()))?;
 
-        // Verify the JWT (signature + expiry). We deliberately do NOT trust its role/ban
-        // claims — the live user row below is authoritative — so the decoded claims
-        // themselves aren't needed beyond this check.
+        // Verify the JWT's signature. Expiry is deliberately NOT enforced here (see
+        // `jwt::verify_token`) — the authoritative, sliding session lifetime lives in the
+        // `session` row read below. We also don't trust the token's role/ban claims; the
+        // live user row is authoritative, so the decoded claims aren't needed beyond this.
         jwt::verify_token(token, &state.config.jwt_secret)
             .map_err(|_| AppError::Unauthorized("Token ungültig oder abgelaufen.".into()))?;
 
@@ -55,14 +56,22 @@ impl FromRequestParts<AppState> for AuthUser {
             .map_err(|e| AppError::Internal(e.into()))?
             .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden oder abgelaufen.".into()))?;
 
-        // Update last_seen_at in the background (fire-and-forget). Failures are
-        // non-fatal but worth surfacing — silent swallowing hides DB connection
-        // pressure that would otherwise be the first symptom of a real problem.
+        // Touch last_seen_at AND slide the session's expiry forward (fire-and-forget), so
+        // an active client's session renews instead of hitting the fixed 30-day cliff.
+        // Admin sessions keep their tighter 1-day window (they renew on activity but still
+        // lapse a day after the admin goes idle). Failures are non-fatal but worth
+        // surfacing — silent swallowing hides DB connection pressure that would otherwise
+        // be the first symptom of a real problem.
         let pool = state.pool.clone();
         let touch_hash = token_hash.clone();
+        let expiry_days = if user.role == UserRole::Admin {
+            1
+        } else {
+            state.config.session_expiry_days
+        };
         tokio::spawn(async move {
-            if let Err(e) = Session::touch_by_token_hash(&pool, &touch_hash).await {
-                tracing::warn!(error = ?e, "session touch failed");
+            if let Err(e) = Session::touch_and_renew(&pool, &touch_hash, expiry_days).await {
+                tracing::warn!(error = ?e, "session touch/renew failed");
             }
         });