fix(review-2): high — read-only ban model, failed-compression cleanup, live SSE eviction

H1: corrected a round-1 over-reach. Bans are read-only per USER_JOURNEYS §10:
    the base AuthUser extractor no longer rejects banned users (they keep read
    access); Require{Host,Admin} and write handlers enforce the ban via
    auth.is_banned → 403 (incl. self-unban). Demoted hosts still lose powers
    immediately (live DB role) and are bounced off the dashboard. Also fixed the
    login/recover redirect regression on unauthenticated 401.

H2: failed compression now self-heals instead of leaving a permanent broken
    card — refund the quota, delete the orphaned original, soft-delete the row;
    the frontend toasts the uploader and evicts the card on upload-error.

H3: self-delete, ban-with-hide (user-hidden), and comment-deletes now broadcast
    SSE; feed, diashow, and lightbox evict the affected content live instead of
    waiting for a reload. sse-eviction.spec.ts covers it.

Riders: feed/+page.svelte also carries the medium truncated-delta pill; host.rs
also carries the low atomic release_gallery claim; admin/+page.svelte also drops
the dead compression_concurrency control (medium).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/routes/host/+page.svelte

@@ -2,6 +2,7 @@
 	import { goto } from '$app/navigation';
 	import { getToken, getRole } from '$lib/auth';
 	import { api } from '$lib/api';
+	import type { MeContextDto } from '$lib/types';
 	import { onMount } from 'svelte';
 	import { toast, toastError } from '$lib/toast-store';
 	import ConfirmSheet from '$lib/components/ConfirmSheet.svelte';
@@ -86,8 +87,22 @@
 
 	onMount(async () => {
 		const token = getToken();
-		const role = getRole();
-		if (!token || (role !== 'host' && role !== 'admin')) {
+		if (!token) {
+			goto('/join');
+			return;
+		}
+		// Trust the *live* role, not the JWT claim: a mid-session demote leaves a
+		// stale 'host' in the token, but the backend now 403s every host call. Fetch
+		// the current role and bounce a demoted host to the feed instead of leaving
+		// them on a dashboard that errors on load.
+		try {
+			const ctx = await api.get<MeContextDto>('/me/context');
+			if (ctx.role !== 'host' && ctx.role !== 'admin') {
+				goto('/feed');
+				return;
+			}
+		} catch {
+			// Expired/invalid session (api.ts cleared it) — send them to re-auth.
 			goto('/join');
 			return;
 		}