fix(security): harden authz, media gating, recover, SSE, deps

Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.

F1 [Med] Host privilege boundary: a host could demote a peer host to
  guest and then ban / PIN-reset (→ account takeover via /recover) them,
  because the ban/pin-reset peer guards key off the target's *current*
  role. set_role now blocks a non-admin from demoting a host.

F2 [Med] Moderation now revokes preview/thumbnail access: they are served
  through visibility-checked aliases (/api/v1/upload/{id}/{preview,
  thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
  /media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
  Caddy keeps them privately cacheable (max-age=300, short so moderation
  revokes promptly — the live feed already evicts cards via SSE). Uses a
  lean find_visible_media() (paths+mime only) on the media hot path.

F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
  devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.

F4 [Low] /recover no longer leaks account existence: unknown display name
  returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
  timing matches — closing the enumeration + timing oracle.

F5 [Low] SSE streams re-validate the session every ~60s and close once it
  is logged out / expired, instead of running until client disconnect.

F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
  media responses (defense-in-depth alongside the edge).

Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/models/upload.rs

@@ -35,6 +35,16 @@ pub struct UploadDto {
     pub created_at: DateTime<Utc>,
 }
 
+/// Minimal projection of an upload's on-disk file paths, used by the visibility-gated
+/// media aliases so they don't hydrate the entire `Upload` row per request.
+#[derive(Debug, sqlx::FromRow)]
+pub struct VisibleMedia {
+    pub original_path: String,
+    pub preview_path: Option<String>,
+    pub thumbnail_path: Option<String>,
+    pub mime_type: String,
+}
+
 impl Upload {
     /// Takes any executor so the caller can run it inside a transaction (atomic
     /// quota + insert) or standalone against the pool.
@@ -74,14 +84,22 @@ impl Upload {
         .await
     }
 
-    /// Like [`Self::find_by_id`] but also excludes uploads whose owner has been
-    /// ban-hidden (`user.uploads_hidden`). Used by the public original-file alias
-    /// so that moderation which hides a user's content from the feed/export also
-    /// stops their full-resolution originals from being pulled by UUID. Mirrors the
-    /// `uploads_hidden` filter that `v_feed` already applies to the feed.
-    pub async fn find_by_id_visible(pool: &PgPool, id: Uuid) -> Result<Option<Self>, sqlx::Error> {
-        sqlx::query_as::<_, Self>(
-            "SELECT up.* FROM upload up
+    /// Lean lookup for the public media aliases (`get_original`/`get_preview`/
+    /// `get_thumbnail`): returns ONLY the file paths + mime for a visible upload —
+    /// excluding soft-deleted rows and ban-hidden owners (`user.uploads_hidden`), the
+    /// same filter `v_feed` applies. So moderation that removes a post from the feed
+    /// also stops its original/preview/thumbnail from being pulled by UUID.
+    ///
+    /// Selects four columns instead of the whole `Upload` row: this runs once per image
+    /// per cache-miss on the media hot path, so we avoid hydrating fields the response
+    /// never uses.
+    pub async fn find_visible_media(
+        pool: &PgPool,
+        id: Uuid,
+    ) -> Result<Option<VisibleMedia>, sqlx::Error> {
+        sqlx::query_as::<_, VisibleMedia>(
+            "SELECT up.original_path, up.preview_path, up.thumbnail_path, up.mime_type
+             FROM upload up
              JOIN \"user\" u ON u.id = up.user_id
              WHERE up.id = $1 AND up.deleted_at IS NULL AND u.uploads_hidden = false",
         )