fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/handlers/upload.rs

@@ -77,6 +77,13 @@ pub async fn upload(
         drain_multipart(multipart).await;
         return Err(AppError::Forbidden("Uploads sind gesperrt.".into()));
     }
+    // Belt-and-suspenders on top of the lock (release ⇒ lock): once the gallery is
+    // released the export has been snapshotted, so a late upload could never make it into
+    // the keepsake. Reject it explicitly rather than silently diverging the live feed.
+    if event.export_released_at.is_some() {
+        drain_multipart(multipart).await;
+        return Err(AppError::Forbidden("Galerie wurde bereits freigegeben.".into()));
+    }
 
     // Read config limits from DB
     let max_image_mb: i64 = config::get_i64(&state.config_cache, "max_image_size_mb", 20).await;
@@ -213,15 +220,21 @@ pub async fn upload(
     // disable it on trusted instances.
     let quota_on = config::get_bool(&state.config_cache, "quota_enabled", true).await;
     let storage_quota_on = config::get_bool(&state.config_cache, "storage_quota_enabled", true).await;
+    // When quota is enforced, this holds the byte ceiling so the increment UPDATE below can
+    // enforce it atomically (`WHERE total + size <= limit`). Without that guard, two
+    // concurrent uploads from the same user (e.g. phone + laptop) both pass this stale
+    // pre-check and both increment, blowing past the quota. The pre-check stays as a
+    // fast path that avoids the disk write when the user is already clearly over.
+    let mut quota_limit: Option<i64> = None;
     if quota_on && storage_quota_on {
         let estimate = compute_storage_quota(&state).await;
         if let Some(limit) = estimate.limit_bytes {
+            quota_limit = Some(limit);
             let prospective_total = user.total_upload_bytes.saturating_add(size);
             if prospective_total > limit {
                 let _ = tokio::fs::remove_file(&temp_abs).await;
-                return Err(AppError::TooManyRequests(
+                return Err(AppError::QuotaExceeded(
                     "Du hast dein Upload-Limit für dieses Event erreicht.".into(),
-                    None,
                 ));
             }
         }
@@ -256,11 +269,33 @@ pub async fn upload(
     // bytes with no row to reclaim them (silent quota erosion / spurious lockout).
     let tx_result: Result<Upload, AppError> = async {
         let mut tx = state.pool.begin().await?;
-        sqlx::query("UPDATE \"user\" SET total_upload_bytes = total_upload_bytes + $2 WHERE id = $1")
+        // Increment the user's byte total. When a quota is in force, guard it atomically
+        // (`total + size <= limit`) so two concurrent uploads can't both slip past the
+        // stale pre-check — the loser's UPDATE matches 0 rows and we abort with the same
+        // terminal quota error (the tx rolls back on drop; the on-disk file is cleaned by
+        // the error path below).
+        let inc = if let Some(limit) = quota_limit {
+            sqlx::query(
+                "UPDATE \"user\" SET total_upload_bytes = total_upload_bytes + $2
+                 WHERE id = $1 AND total_upload_bytes + $2 <= $3",
+            )
             .bind(auth.user_id)
             .bind(size)
+            .bind(limit)
             .execute(&mut *tx)
-            .await?;
+            .await?
+        } else {
+            sqlx::query("UPDATE \"user\" SET total_upload_bytes = total_upload_bytes + $2 WHERE id = $1")
+                .bind(auth.user_id)
+                .bind(size)
+                .execute(&mut *tx)
+                .await?
+        };
+        if inc.rows_affected() == 0 {
+            return Err(AppError::QuotaExceeded(
+                "Du hast dein Upload-Limit für dieses Event erreicht.".into(),
+            ));
+        }
         let upload = Upload::create(
             &mut *tx,
             auth.event_id,