Merge fix/security-review-batch-2: cross-event authz + upload OOM backstop

Brings the batch-2 security hardening into main (forked from the same base as
the UX batch; auto-merged cleanly — verified both sides' edits to social.rs /
main.rs coexist):

- Cross-event authorization: toggle_like / list_comments / add_comment now
  event-scope the upload via Upload::find_by_id_and_event (404 on cross-event
  access); delete_comment uses Comment::soft_delete_in_event. Closes the gap
  where a guest could like/comment/list across events by upload UUID.
- Upload OOM backstop: the /upload route gets DefaultBodyLimit::max(576 MiB)
  instead of disable(), so a multi-GB body can't be buffered before the
  handler's per-class size checks run.
- upload.rs per-class size-limit refactor, XSS allowlist, deploy hardening
  (Caddyfile, Dockerfiles, docker-compose, .env.example), and a data-mode
  doc-comment clarifying the original-media route is capability-(UUID-)gated.

The event-scope checks sit before, and batch-3's best-effort count broadcasts
after, the like/comment mutations — both preserved.

Verified: cargo build clean, svelte-check 0 errors.

backend/src/handlers/social.rs

@@ -9,6 +9,7 @@ use crate::auth::middleware::AuthUser;
 use crate::error::AppError;
 use crate::models::comment::{Comment, CommentDto};
 use crate::models::hashtag::{self, Hashtag};
+use crate::models::upload::Upload;
 use crate::state::AppState;
 
 pub async fn toggle_like(
@@ -24,6 +25,12 @@ pub async fn toggle_like(
         return Err(AppError::Forbidden("Du bist gesperrt.".into()));
     }
 
+    // Event-scope: the upload must belong to the caller's event (404 otherwise),
+    // matching the host handlers' find_by_id_and_event pattern.
+    Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+
     // Try to insert; if conflict, delete (toggle)
     let result = sqlx::query(
         "INSERT INTO \"like\" (upload_id, user_id) VALUES ($1, $2)
@@ -76,10 +83,15 @@ const COMMENT_PAGE_SIZE: i64 = 50;
 
 pub async fn list_comments(
     State(state): State<AppState>,
-    _auth: AuthUser,
+    auth: AuthUser,
     Path(upload_id): Path<Uuid>,
     Query(q): Query<ListCommentsQuery>,
 ) -> Result<Json<Vec<CommentDto>>, AppError> {
+    // Event-scope: only list comments for an upload in the caller's event.
+    Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+
     let comments =
         Comment::list_for_upload(&state.pool, upload_id, q.before, COMMENT_PAGE_SIZE).await?;
     Ok(Json(comments))
@@ -103,6 +115,11 @@ pub async fn add_comment(
         return Err(AppError::Forbidden("Du bist gesperrt.".into()));
     }
 
+    // Event-scope: only comment on an upload that belongs to the caller's event.
+    Upload::find_by_id_and_event(&state.pool, upload_id, auth.event_id)
+        .await?
+        .ok_or_else(|| AppError::NotFound("Upload nicht gefunden.".into()))?;
+
     let text = body.body.trim();
     let text_chars = text.chars().count();
     if text_chars == 0 || text_chars > 500 {
@@ -170,6 +187,11 @@ pub async fn delete_comment(
         return Err(AppError::Forbidden("Nur eigene Kommentare löschen.".into()));
     }
 
-    Comment::soft_delete(&state.pool, comment_id).await?;
+    // Event-scope: soft_delete_in_event only matches comments whose upload is in
+    // the caller's event, so a cross-event comment_id resolves to a 404 here.
+    let deleted = Comment::soft_delete_in_event(&state.pool, comment_id, auth.event_id).await?;
+    if !deleted {
+        return Err(AppError::NotFound("Kommentar nicht gefunden.".into()));
+    }
     Ok(StatusCode::NO_CONTENT)
 }