fix(user-flow): close offline-queue, export, session, ban & realtime gaps

Comprehensive user-flow review across guest/host/admin roles, then fixes with
e2e regression guards. Highlights:

- Offline upload queue auto-resumes on reconnect: network errors keep items
  pending (not error), 4xx are terminal (no infinite retry), quota exhaustion
  returns a distinct 413; queue cap + dedup.
- Export lifecycle: release atomically locks uploads; reopen invalidates and
  re-release regenerates the keepsake; workers claim their job atomically so a
  reopen->re-release can't corrupt the ZIP; startup re-spawns interrupted
  exports.
- Sessions slide on activity (no 30-day cliff); JWT expiry deferred to the
  revocable session row; sign-out-everywhere + revoke-on-PIN-reset.
- Ban always hides content (v_feed / find_visible_media / export filter
  is_banned) but stays a read-only ban per USER_JOURNEYS §10 — sessions are
  not revoked, read access + keepsake download preserved.
- Realtime: server-clock SSE delta cursor; event-closed/opened drive the UI
  live; feed_delta rate-limited; like returns {liked, like_count} to fix
  multi-device drift; lightbox live comments; diashow delta backfill.
- Forgotten-PIN in-app request flow; simultaneous same-name join returns 409;
  quota increment is transactional; operator floor.

Adds e2e/specs/10-flow-review/ (offline resume, export integrity, deterministic
anti-race guard) and updates existing specs for the new contracts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/routes/join/+page.svelte

@@ -29,6 +29,9 @@
 	let recoveryPin = $state('');
 	let recoveryError = $state('');
 	let recoveryLoading = $state(false);
+	// Forgot-PIN request state (asks a host to reset it).
+	let pinRequestSent = $state(false);
+	let pinRequestLoading = $state(false);
 
 	async function handleJoin() {
 		if (!displayName.trim()) return;
@@ -85,9 +88,24 @@
 		nameTaken = false;
 		recoveryPin = '';
 		recoveryError = '';
+		pinRequestSent = false;
 		// Keep displayName so the user can edit it slightly
 	}
 
+	// Forgot the PIN entirely: ask a host to reset it. The endpoint always 204s (no name
+	// enumeration), so we optimistically show a confirmation regardless.
+	async function requestPinReset() {
+		pinRequestLoading = true;
+		try {
+			await api.post('/recover/request', { display_name: takenName });
+		} catch {
+			// Non-fatal (rate limit etc.) — still show the confirmation so the user isn't stuck.
+		} finally {
+			pinRequestLoading = false;
+			pinRequestSent = true;
+		}
+	}
+
 	function copyPin() {
 		navigator.clipboard.writeText(pin);
 		copied = true;
@@ -173,6 +191,23 @@
 				Anderen Namen wählen
 			</button>
 
+			<!-- Forgot the PIN entirely — ask a host to reset it in-app. -->
+			{#if pinRequestSent}
+				<p class="mt-3 rounded-lg bg-green-50 px-4 py-3 text-center text-sm text-green-700 dark:bg-green-950/30 dark:text-green-300">
+					Anfrage gesendet. Bitte einen Host, deine PIN zurückzusetzen — danach kannst du dich
+					mit der neuen PIN anmelden.
+				</p>
+			{:else}
+				<button
+					onclick={requestPinReset}
+					disabled={pinRequestLoading}
+					data-testid="request-pin-reset"
+					class="mt-3 w-full text-center text-sm text-blue-600 underline decoration-dotted underline-offset-2 hover:text-blue-700 disabled:opacity-50 dark:text-blue-400"
+				>
+					{pinRequestLoading ? 'Wird gesendet…' : 'PIN vergessen? Host um Zurücksetzen bitten'}
+				</button>
+			{/if}
+
 		{:else}
 			<!-- Normal join form -->
 			<h1 class="mb-2 text-center text-2xl font-bold text-gray-900 dark:text-gray-100">Willkommen!</h1>