fix(security): medium/low — event-lock, atomic config, a11y, diashow, hygiene

- social: likes/comments rejected on a closed event (e2e proven).
- admin: patch_config validates-then-writes atomically; char-based length.
- hashtag/comment models: atomic tag writes in edit + comment paths.
- Modal: inert the background (modal-inert action) for screen readers.
- sse.ts: idempotent visibilitychange listener (no duplicate reconnects).
- diashow: videos advance on `ended` (transitions + page wiring).
- docs/hygiene: README clone-case fix; removed stale committed .env.test and
  gitignored it; docker-compose.dev.yml tidy.

Left documented as accepted-risk per plan: PIN-persist-after-logout,
UUID-reachable hidden uploads, DECISION-media-auth.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/components/Modal.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
 	import { focusTrap } from '$lib/actions/focus-trap';
 	import { scrollLock } from '$lib/actions/scroll-lock';
+	import { modalInert } from '$lib/actions/modal-inert';
 	import type { Snippet } from 'svelte';
 
 	// Accessible name is REQUIRED. Pass `titleId` when the dialog renders its own
@@ -35,24 +36,29 @@
 </script>
 
 {#if open}
-	<button
-		type="button"
-		class="fixed inset-0 z-50 bg-black/50"
-		aria-label="Schließen"
-		tabindex="-1"
-		onclick={closeOnBackdrop ? onClose : () => {}}
-	></button>
-	<div
-		class="pointer-events-none fixed inset-0 z-50 flex items-center justify-center p-4"
-		role="dialog"
-		aria-modal="true"
-		aria-labelledby={titleId}
-		aria-label={titleId ? undefined : ariaLabel}
-		use:focusTrap={{ onclose: onClose }}
-		use:scrollLock
-	>
-		<div class="pointer-events-auto w-full max-w-sm rounded-2xl bg-white p-6 shadow-xl dark:bg-gray-900">
-			{@render children()}
+	<!-- display:contents wrapper: keeps the backdrop + dialog visually unchanged
+	     while giving `modalInert` a single node whose siblings (the background
+	     page, nav, etc.) get inerted for assistive tech. -->
+	<div class="contents" use:modalInert>
+		<button
+			type="button"
+			class="fixed inset-0 z-50 bg-black/50"
+			aria-label="Schließen"
+			tabindex="-1"
+			onclick={closeOnBackdrop ? onClose : () => {}}
+		></button>
+		<div
+			class="pointer-events-none fixed inset-0 z-50 flex items-center justify-center p-4"
+			role="dialog"
+			aria-modal="true"
+			aria-labelledby={titleId}
+			aria-label={titleId ? undefined : ariaLabel}
+			use:focusTrap={{ onclose: onClose }}
+			use:scrollLock
+		>
+			<div class="pointer-events-auto w-full max-w-sm rounded-2xl bg-white p-6 shadow-xl dark:bg-gray-900">
+				{@render children()}
+			</div>
 		</div>
 	</div>
 {/if}