fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/handlers/sse.rs

@@ -23,6 +23,10 @@ pub struct SseQuery {
 #[derive(Serialize)]
 pub struct StreamTicketResponse {
     pub ticket: String,
+    /// Server clock at mint time — the client seeds its SSE reconnect cursor from this
+    /// instead of `new Date()`, so a skewed browser clock can't drop uploads. See
+    /// `DeltaResponse::server_time`.
+    pub server_time: chrono::DateTime<chrono::Utc>,
 }
 
 /// Mint a short-lived single-use SSE ticket. The browser's `EventSource` cannot
@@ -33,9 +37,12 @@ pub struct StreamTicketResponse {
 pub async fn issue_ticket(
     State(state): State<AppState>,
     auth: AuthUser,
-) -> Json<StreamTicketResponse> {
+) -> Result<Json<StreamTicketResponse>, AppError> {
     let ticket = state.sse_tickets.issue(auth.token_hash);
-    Json(StreamTicketResponse { ticket })
+    let server_time = sqlx::query_scalar("SELECT NOW()")
+        .fetch_one(&state.pool)
+        .await?;
+    Ok(Json(StreamTicketResponse { ticket, server_time }))
 }
 
 /// SSE stream endpoint. Authenticates via a single-use ticket (see
@@ -74,9 +81,12 @@ pub async fn stream(
     });
 
     // The session is only checked once at open. Re-validate it periodically so a
-    // logged-out or expired session's stream is closed rather than kept alive until the
-    // client happens to disconnect. Bounds a stale stream to ~60s. Only a *definitively*
-    // gone/expired session ends the stream; a transient DB error just retries next tick.
+    // logged-out, expired, OR banned session's stream is closed rather than kept alive
+    // until the client happens to disconnect. Bounds a stale stream to ~60s. Banning
+    // already revokes the user's sessions (so the row is gone), but re-reading the live
+    // user row and dropping on `is_banned` is a cheap defense-in-depth. Only a
+    // *definitive* gone/expired/banned state ends the stream; a transient DB error just
+    // retries next tick.
     let pool = state.pool.clone();
     let session_hash = token_hash.clone();
     let session_gone = async move {
@@ -84,9 +94,10 @@ pub async fn stream(
         ticker.tick().await; // consume the immediate first tick
         loop {
             ticker.tick().await;
-            match Session::find_by_token_hash(&pool, &session_hash).await {
-                Ok(Some(_)) => {}   // still valid — keep streaming
-                Ok(None) => break,  // logged out or expired — stop
+            match Session::find_user_by_token_hash(&pool, &session_hash).await {
+                Ok(Some(user)) if !user.is_banned => {} // still valid — keep streaming
+                Ok(Some(_)) => break,                   // banned — cut the stream
+                Ok(None) => break,                      // logged out or expired — stop
                 Err(e) => {
                     tracing::warn!(error = ?e, "SSE session revalidation query failed; retrying");
                 }