fix(security): harden authz, media gating, recover, SSE, deps

Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.

F1 [Med] Host privilege boundary: a host could demote a peer host to
  guest and then ban / PIN-reset (→ account takeover via /recover) them,
  because the ban/pin-reset peer guards key off the target's *current*
  role. set_role now blocks a non-admin from demoting a host.

F2 [Med] Moderation now revokes preview/thumbnail access: they are served
  through visibility-checked aliases (/api/v1/upload/{id}/{preview,
  thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
  /media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
  Caddy keeps them privately cacheable (max-age=300, short so moderation
  revokes promptly — the live feed already evicts cards via SSE). Uses a
  lean find_visible_media() (paths+mime only) on the media hot path.

F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
  devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.

F4 [Low] /recover no longer leaks account existence: unknown display name
  returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
  timing matches — closing the enumeration + timing oracle.

F5 [Low] SSE streams re-validate the session every ~60s and close once it
  is logged out / expired, instead of running until client disconnect.

F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
  media responses (defense-in-depth alongside the edge).

Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/feed.rs

@@ -139,8 +139,17 @@ pub async fn feed(
     let uploads = rows
         .into_iter()
         .map(|r| {
-            let preview_url = r.preview_path.map(|p| format!("/media/{p}"));
-            let thumbnail_url = r.thumbnail_path.map(|p| format!("/media/{p}"));
+            // Gated media aliases (visibility-checked, direct /media blocked). Emit the
+            // URL only when the variant actually exists — the URL is what signals the
+            // client which variant to load.
+            let preview_url = r
+                .preview_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/preview", r.id));
+            let thumbnail_url = r
+                .thumbnail_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id));
             FeedUpload {
                 liked_by_me: liked_set.contains(&r.id),
                 id: r.id,
@@ -225,8 +234,14 @@ pub async fn feed_delta(
             id: r.id,
             user_id: r.user_id,
             uploader_name: r.uploader_name,
-            preview_url: r.preview_path.map(|p| format!("/media/{p}")),
-            thumbnail_url: r.thumbnail_path.map(|p| format!("/media/{p}")),
+            preview_url: r
+                .preview_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/preview", r.id)),
+            thumbnail_url: r
+                .thumbnail_path
+                .as_ref()
+                .map(|_| format!("/api/v1/upload/{}/thumbnail", r.id)),
             mime_type: r.mime_type,
             caption: r.caption,
             like_count: r.like_count,