fix(review-2): high — read-only ban model, failed-compression cleanup, live SSE eviction

H1: corrected a round-1 over-reach. Bans are read-only per USER_JOURNEYS §10:
    the base AuthUser extractor no longer rejects banned users (they keep read
    access); Require{Host,Admin} and write handlers enforce the ban via
    auth.is_banned → 403 (incl. self-unban). Demoted hosts still lose powers
    immediately (live DB role) and are bounced off the dashboard. Also fixed the
    login/recover redirect regression on unauthenticated 401.

H2: failed compression now self-heals instead of leaving a permanent broken
    card — refund the quota, delete the orphaned original, soft-delete the row;
    the frontend toasts the uploader and evicts the card on upload-error.

H3: self-delete, ban-with-hide (user-hidden), and comment-deletes now broadcast
    SSE; feed, diashow, and lightbox evict the affected content live instead of
    waiting for a reload. sse-eviction.spec.ts covers it.

Riders: feed/+page.svelte also carries the medium truncated-delta pill; host.rs
also carries the low atomic release_gallery claim; admin/+page.svelte also drops
the dead compression_concurrency control (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth/middleware.rs

@@ -13,6 +13,10 @@ pub struct AuthUser {
     pub user_id: Uuid,
     pub event_id: Uuid,
     pub role: UserRole,
+    /// Live ban flag. Banned users keep *read* access (per USER_JOURNEYS §10), so
+    /// the base extractor does NOT reject them — write handlers and the
+    /// Require{Host,Admin} extractors enforce the ban instead.
+    pub is_banned: bool,
     pub token_hash: String,
 }
 
@@ -45,15 +49,13 @@ impl FromRequestParts<AppState> for AuthUser {
 
         // Trust *live* DB state, not the JWT: a role/ban stored in the token would
         // survive a demote/ban for the full session lifetime (up to 30d). Re-read
-        // the user row so a demoted host loses host powers and a banned user is
-        // locked out immediately on their next request.
+        // the user row so a demoted host loses host powers immediately. We do NOT
+        // reject banned users here — they retain read access by design; writes and
+        // host/admin actions enforce the ban downstream.
         let user = crate::models::user::User::find_by_id(&state.pool, claims.sub)
             .await
             .map_err(|e| AppError::Internal(e.into()))?
             .ok_or_else(|| AppError::Unauthorized("Benutzer nicht gefunden.".into()))?;
-        if user.is_banned {
-            return Err(AppError::Forbidden("Dein Zugang wurde gesperrt.".into()));
-        }
 
         // Update last_seen_at in the background (fire-and-forget). Failures are
         // non-fatal but worth surfacing — silent swallowing hides DB connection
@@ -70,6 +72,7 @@ impl FromRequestParts<AppState> for AuthUser {
             user_id: user.id,
             event_id: user.event_id,
             role: user.role,
+            is_banned: user.is_banned,
             token_hash,
         })
     }
@@ -86,6 +89,9 @@ impl FromRequestParts<AppState> for RequireHost {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Host | UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Hosts und Admins.".into())),
@@ -104,6 +110,9 @@ impl FromRequestParts<AppState> for RequireAdmin {
         state: &AppState,
     ) -> Result<Self, Self::Rejection> {
         let auth = AuthUser::from_request_parts(parts, state).await?;
+        if auth.is_banned {
+            return Err(AppError::Forbidden("Du bist gesperrt.".into()));
+        }
         match auth.role {
             UserRole::Admin => Ok(Self(auth)),
             _ => Err(AppError::Forbidden("Nur für Admins.".into())),