fix(security): medium/low — event-lock, atomic config, a11y, diashow, hygiene

- social: likes/comments rejected on a closed event (e2e proven).
- admin: patch_config validates-then-writes atomically; char-based length.
- hashtag/comment models: atomic tag writes in edit + comment paths.
- Modal: inert the background (modal-inert action) for screen readers.
- sse.ts: idempotent visibilitychange listener (no duplicate reconnects).
- diashow: videos advance on `ended` (transitions + page wiring).
- docs/hygiene: README clone-case fix; removed stale committed .env.test and
  gitignored it; docker-compose.dev.yml tidy.

Left documented as accepted-risk per plan: PIN-persist-after-logout,
UUID-reachable hidden uploads, DECISION-media-auth.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/routes/diashow/+page.svelte

@@ -52,6 +52,13 @@
 		if (current) scheduleNext();
 	}
 
+	// A video finished before its dwell/12s cap — advance immediately (unless paused).
+	// The {#key current.id} block destroys the old <video> on advance, so a fallback
+	// timer that already fired can't trigger this handler for a stale slide.
+	function handleVideoEnded() {
+		if (!paused) advance();
+	}
+
 	async function loadInitial() {
 		try {
 			const feed = await api.get<FeedResponse>('/feed?limit=200');
@@ -163,6 +170,7 @@
 				src={mediaSrc}
 				{isVideo}
 				durationMs={transitionDef.defaultDurationMs}
+				onended={handleVideoEnded}
 			/>
 		{/key}
 	{:else if isEmpty()}