fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

e2e/specs/03-feed/like-comment.spec.ts

@@ -31,21 +31,21 @@ test.describe('Feed — like + comment', () => {
     expect(row.liked_by_me).toBe(false);
 
     // First like → counted exactly once.
-    expect(await like(liker.jwt, uploadId)).toBe(204);
+    expect(await like(liker.jwt, uploadId)).toBe(200);
     row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(1);
     expect(row.liked_by_me).toBe(true);
 
     // Liking again is a toggle → back to zero (guards against a regression that
     // double-counts a repeated like instead of removing it).
-    expect(await like(liker.jwt, uploadId)).toBe(204);
+    expect(await like(liker.jwt, uploadId)).toBe(200);
     row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(0);
     expect(row.liked_by_me).toBe(false);
 
     // A second distinct user's like is counted independently (per-user semantics).
-    expect(await like(liker.jwt, uploadId)).toBe(204); // liker likes again → 1
-    expect(await like(author.jwt, uploadId)).toBe(204); // author likes too → 2
+    expect(await like(liker.jwt, uploadId)).toBe(200); // liker likes again → 1
+    expect(await like(author.jwt, uploadId)).toBe(200); // author likes too → 2
     row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(2);
   });