fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/models/session.rs

@@ -65,13 +65,25 @@ impl Session {
         .await
     }
 
-    /// Update `last_seen_at`, keyed by the token hash so the auth extractor can touch a
-    /// session without a separate query to fetch its id first.
-    pub async fn touch_by_token_hash(pool: &PgPool, token_hash: &str) -> Result<(), sqlx::Error> {
-        sqlx::query("UPDATE session SET last_seen_at = NOW() WHERE token_hash = $1")
-            .bind(token_hash)
-            .execute(pool)
-            .await?;
+    /// Touch `last_seen_at` AND slide `expires_at` forward by `expiry_days` from now, so
+    /// an actively-used session never hits the fixed 30-day cliff (it renews on every
+    /// authenticated request). An idle session still expires `expiry_days` after its last
+    /// activity. Keyed by token hash so the auth extractor needs no prior id lookup.
+    pub async fn touch_and_renew(
+        pool: &PgPool,
+        token_hash: &str,
+        expiry_days: i64,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query(
+            "UPDATE session
+             SET last_seen_at = NOW(),
+                 expires_at = NOW() + ($2 || ' days')::interval
+             WHERE token_hash = $1",
+        )
+        .bind(token_hash)
+        .bind(expiry_days.to_string())
+        .execute(pool)
+        .await?;
         Ok(())
     }
 
@@ -85,4 +97,14 @@ impl Session {
             .await?;
         Ok(())
     }
+
+    /// Revoke every session for a user. Backs "sign out everywhere" and the forced
+    /// re-auth after a host PIN-reset or a ban. Returns the number of sessions cleared.
+    pub async fn delete_all_for_user(pool: &PgPool, user_id: Uuid) -> Result<u64, sqlx::Error> {
+        let r = sqlx::query("DELETE FROM session WHERE user_id = $1")
+            .bind(user_id)
+            .execute(pool)
+            .await?;
+        Ok(r.rows_affected())
+    }
 }