fix(review-2): high — read-only ban model, failed-compression cleanup, live SSE eviction

H1: corrected a round-1 over-reach. Bans are read-only per USER_JOURNEYS §10:
    the base AuthUser extractor no longer rejects banned users (they keep read
    access); Require{Host,Admin} and write handlers enforce the ban via
    auth.is_banned → 403 (incl. self-unban). Demoted hosts still lose powers
    immediately (live DB role) and are bounced off the dashboard. Also fixed the
    login/recover redirect regression on unauthenticated 401.

H2: failed compression now self-heals instead of leaving a permanent broken
    card — refund the quota, delete the orphaned original, soft-delete the row;
    the frontend toasts the uploader and evicts the card on upload-error.

H3: self-delete, ban-with-hide (user-hidden), and comment-deletes now broadcast
    SSE; feed, diashow, and lightbox evict the affected content live instead of
    waiting for a reload. sse-eviction.spec.ts covers it.

Riders: feed/+page.svelte also carries the medium truncated-delta pill; host.rs
also carries the low atomic release_gallery claim; admin/+page.svelte also drops
the dead compression_concurrency control (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -68,6 +68,9 @@ async function request<T>(
 	}
 
 	if (!res.ok) {
+		// An expired/invalid token (401) clears the dead session. Banned users are
+		// NOT logged out — they keep read access by design (USER_JOURNEYS §10) and
+		// simply get a 403 "gesperrt" toast on writes.
 		if (res.status === 401) {
 			clearAuth();
 		}

frontend/src/lib/diashow/queue.ts

@@ -73,6 +73,23 @@ export class SlideQueue {
 		return { wasCurrent: currentId === id };
 	}
 
+	/**
+	 * Remove every slide belonging to a user (banned with hide_uploads). Returns
+	 * true if the current head was one of them so the caller advances immediately.
+	 */
+	removeByUser(userId: string, currentId: string | null): { wasCurrent: boolean } {
+		let wasCurrent = false;
+		for (const [id, slide] of this.allKnown) {
+			if (slide.user_id === userId) {
+				if (id === currentId) wasCurrent = true;
+				this.allKnown.delete(id);
+			}
+		}
+		this.liveQueue = this.liveQueue.filter((s) => s.user_id !== userId);
+		this.shuffleQueue = this.shuffleQueue.filter((s) => s.user_id !== userId);
+		return { wasCurrent };
+	}
+
 	/** Look up a slide by id — for the diashow page to render the current slide. */
 	get(id: string): FeedUpload | undefined {
 		return this.allKnown.get(id);

frontend/src/routes/admin/+page.svelte

@@ -57,8 +57,9 @@
 			title: 'Limits & Größen',
 			fields: [
 				{ key: 'max_image_size_mb',       label: 'Max. Bildgröße (MB)',     kind: 'number' },
-				{ key: 'max_video_size_mb',       label: 'Max. Videogröße (MB)',    kind: 'number' },
-				{ key: 'compression_concurrency', label: 'Kompressions-Worker',     kind: 'number' }
+				{ key: 'max_video_size_mb',       label: 'Max. Videogröße (MB)',    kind: 'number' }
+				// compression_concurrency is set via COMPRESSION_WORKER_CONCURRENCY at
+				// boot, not live — omitted so it isn't a dead no-op control.
 			]
 		},
 		{

frontend/src/routes/diashow/+page.svelte

@@ -99,6 +99,16 @@
 		}
 	}
 
+	function handleUserHidden(data: string) {
+		try {
+			const payload = JSON.parse(data) as { user_id: string };
+			const result = queue.removeByUser(payload.user_id, current?.id ?? null);
+			if (result.wasCurrent) advance();
+		} catch {
+			// ignore
+		}
+	}
+
 	function revealOverlay() {
 		showOverlay = true;
 		if (overlayHideTimer) clearTimeout(overlayHideTimer);
@@ -145,6 +155,7 @@
 		void acquireWakeLock();
 		unsubs.push(onSseEvent('upload-processed', handleUploadProcessed));
 		unsubs.push(onSseEvent('upload-deleted', handleUploadDeleted));
+		unsubs.push(onSseEvent('user-hidden', handleUserHidden));
 		void loadInitial();
 	});
 

frontend/src/routes/feed/+page.svelte

@@ -27,6 +27,9 @@
 	let refreshing = $state(false);
 	let pullProgress = $state(0); // 0–1+ during the drag, 0 when idle
 	let selectedUpload = $state<FeedUpload | null>(null);
+	// Set when a truncated feed-delta means we missed too much to merge — shows a
+	// tap-to-refresh pill instead of yanking the user's scroll to page 1.
+	let feedStale = $state(false);
 	let sentinel: HTMLDivElement;
 	let feedObserver: IntersectionObserver | null = null;
 	let inPlaceRefreshTimer: ReturnType<typeof setTimeout> | null = null;
@@ -196,6 +199,28 @@
 					if (selectedUpload?.id === payload.upload_id) selectedUpload = null;
 				} catch { /* ignore */ }
 			}),
+			// A background transcode failed: the backend already cleaned up (refunded
+			// quota, removed the row) and an upload-deleted evicts the card. Only the
+			// uploader gets a toast — registered before upload-deleted so the card is
+			// still present to check ownership.
+			onSseEvent('upload-error', (data) => {
+				try {
+					const { upload_id } = JSON.parse(data) as { upload_id: string };
+					const mine = uploads.find((u) => u.id === upload_id && u.user_id === myUserId);
+					if (mine) {
+						toast('Ein Upload konnte nicht verarbeitet werden.', 'error');
+						void refreshQuota();
+					}
+				} catch { /* ignore */ }
+			}),
+			// A banned user's uploads were hidden — drop all their cards live.
+			onSseEvent('user-hidden', (data) => {
+				try {
+					const { user_id } = JSON.parse(data) as { user_id: string };
+					uploads = uploads.filter((u) => u.user_id !== user_id);
+					if (selectedUpload && selectedUpload.user_id === user_id) selectedUpload = null;
+				} catch { /* ignore */ }
+			}),
 			// Patch the single affected card in place from the SSE payload instead of
 			// refetching page 1 — a busy event fires these constantly and a full reload
 			// would yank every scrolled-down user back to the top on each reaction.
@@ -210,7 +235,9 @@
 						// Missed more than the backend delta cap while backgrounded — the
 						// delta is only the newest slice, so merging would leave a silent gap
 						// of older-but-still-new uploads. Resync from page 1 instead.
-						void loadFeed(true);
+						// Rather than involuntarily yank the user to page 1, surface a
+						// tap-to-refresh pill so they keep scroll until they resync.
+						feedStale = true;
 						return;
 					}
 					if (delta.uploads.length) {
@@ -440,6 +467,17 @@
 			</div>
 		</div>
 	{/if}
+	{#if feedStale}
+		<div class="pointer-events-none fixed left-0 right-0 top-[calc(env(safe-area-inset-top)+0.5rem)] z-40 flex justify-center">
+			<button
+				type="button"
+				class="pointer-events-auto rounded-full bg-blue-600 px-4 py-1.5 text-xs font-semibold text-white shadow-lg hover:bg-blue-700"
+				onclick={() => { feedStale = false; void loadFeed(true); }}
+			>
+				Neue Beiträge – tippen zum Aktualisieren
+			</button>
+		</div>
+	{/if}
 	<!-- Sticky header — opaque fallback for browsers without backdrop-filter. -->
 	<div class="sticky top-0 z-30 border-b border-gray-200 bg-white/95 pt-[env(safe-area-inset-top)] backdrop-blur supports-[not(backdrop-filter:blur(0))]:bg-white dark:border-gray-800 dark:bg-gray-900/95 dark:supports-[not(backdrop-filter:blur(0))]:bg-gray-900">
 		<div class="mx-auto flex max-w-2xl items-center justify-between px-4 py-3">

frontend/src/routes/host/+page.svelte

@@ -2,6 +2,7 @@
 	import { goto } from '$app/navigation';
 	import { getToken, getRole } from '$lib/auth';
 	import { api } from '$lib/api';
+	import type { MeContextDto } from '$lib/types';
 	import { onMount } from 'svelte';
 	import { toast, toastError } from '$lib/toast-store';
 	import ConfirmSheet from '$lib/components/ConfirmSheet.svelte';
@@ -86,8 +87,22 @@
 
 	onMount(async () => {
 		const token = getToken();
-		const role = getRole();
-		if (!token || (role !== 'host' && role !== 'admin')) {
+		if (!token) {
+			goto('/join');
+			return;
+		}
+		// Trust the *live* role, not the JWT claim: a mid-session demote leaves a
+		// stale 'host' in the token, but the backend now 403s every host call. Fetch
+		// the current role and bounce a demoted host to the feed instead of leaving
+		// them on a dashboard that errors on load.
+		try {
+			const ctx = await api.get<MeContextDto>('/me/context');
+			if (ctx.role !== 'host' && ctx.role !== 'admin') {
+				goto('/feed');
+				return;
+			}
+		} catch {
+			// Expired/invalid session (api.ts cleared it) — send them to re-auth.
 			goto('/join');
 			return;
 		}