fix(security): harden authz, media gating, recover, SSE, deps

Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.

F1 [Med] Host privilege boundary: a host could demote a peer host to
  guest and then ban / PIN-reset (→ account takeover via /recover) them,
  because the ban/pin-reset peer guards key off the target's *current*
  role. set_role now blocks a non-admin from demoting a host.

F2 [Med] Moderation now revokes preview/thumbnail access: they are served
  through visibility-checked aliases (/api/v1/upload/{id}/{preview,
  thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
  /media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
  Caddy keeps them privately cacheable (max-age=300, short so moderation
  revokes promptly — the live feed already evicts cards via SSE). Uses a
  lean find_visible_media() (paths+mime only) on the media hot path.

F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
  devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.

F4 [Low] /recover no longer leaks account existence: unknown display name
  returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
  timing matches — closing the enumeration + timing oracle.

F5 [Low] SSE streams re-validate the session every ~60s and close once it
  is logged out / expired, instead of running until client disconnect.

F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
  media responses (defense-in-depth alongside the edge).

Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/07-adversarial/media-gating.spec.ts

@@ -0,0 +1,59 @@
+/**
+ * Security fix F2: preview/thumbnail images are now served through a visibility-checked
+ * alias (/api/v1/upload/{id}/preview) instead of the unauthenticated /media ServeDir,
+ * so moderation (delete / ban-hide) actually revokes access to the displayed image —
+ * not just the full-res original. Direct /media/previews access is blocked.
+ */
+import { test, expect } from '../../fixtures/test';
+import { seedUpload } from '../../helpers/seed';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+test.describe('Media gating — moderation revokes preview access (F2)', () => {
+  test('preview served via gated alias, blocked directly, and 404 after delete', async ({
+    host,
+    api,
+  }) => {
+    test.setTimeout(30_000);
+    const id = await seedUpload(host.jwt, { caption: 'gated' });
+
+    // Wait for the compression worker to produce the preview — the feed exposes
+    // `preview_url` only once `preview_path` is set.
+    let previewUrl: string | undefined;
+    await expect
+      .poll(
+        async () => {
+          const feed = await api.getFeed(host.jwt);
+          const row = (feed.uploads ?? []).find((u: any) => u.id === id);
+          previewUrl = row?.preview_url ?? undefined;
+          return previewUrl;
+        },
+        { timeout: 20_000, intervals: [500] }
+      )
+      .toBeTruthy();
+
+    // Feed now emits the gated alias, not a /media path.
+    expect(previewUrl).toBe(`/api/v1/upload/${id}/preview`);
+
+    // The gated alias serves the image with the app-layer nosniff header.
+    const ok = await fetch(`${BASE}${previewUrl}`);
+    expect(ok.status).toBe(200);
+    expect(ok.headers.get('content-type')).toContain('image/jpeg');
+    // App sets nosniff (F6); the edge proxy may also set it → value can be doubled.
+    expect(ok.headers.get('x-content-type-options')).toContain('nosniff');
+
+    // Direct /media access is blocked (404) — the alias is the only way in.
+    const direct = await fetch(`${BASE}/media/previews/${id}.jpg`);
+    expect(direct.status, 'direct /media/previews must be blocked').toBe(404);
+
+    // Host deletes the upload → the preview must stop being served.
+    const del = await fetch(`${BASE}/api/v1/host/upload/${id}`, {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${host.jwt}` },
+    });
+    expect(del.status).toBe(204);
+
+    const afterDelete = await fetch(`${BASE}/api/v1/upload/${id}/preview`);
+    expect(afterDelete.status, 'moderation must revoke preview access').toBe(404);
+  });
+});

e2e/specs/07-adversarial/set-role-host-demote.spec.ts

@@ -0,0 +1,45 @@
+/**
+ * Security fix F1: a plain host must not be able to demote a *peer host*. Before the
+ * fix, `set_role` only blocked `target == admin`, so a host could demote another host
+ * to guest and then ban / PIN-reset (→ account takeover via /recover) them, because the
+ * ban/pin-reset peer guards key off the target's *current* role. This proves the
+ * demotion itself is now blocked for non-admins, while admins and guest-management
+ * still work.
+ */
+import { test, expect } from '../../fixtures/test';
+
+const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
+
+function patchRole(token: string, userId: string, role: string) {
+  return fetch(`${BASE}/api/v1/host/users/${userId}/role`, {
+    method: 'PATCH',
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ role }),
+  });
+}
+
+test.describe('AuthZ — host cannot demote a peer host (F1)', () => {
+  test('host→host demotion is 403; admin may demote; host may still manage guests', async ({
+    host,
+    guest,
+    adminToken,
+    api,
+  }) => {
+    // A second host (the victim) and an ordinary guest.
+    const peer = await guest('PeerHost');
+    await api.setRole(adminToken, peer.userId, 'host');
+    const plain = await guest('PlainGuest');
+
+    // Attacker host tries to demote the peer host — must be refused.
+    const attack = await patchRole(host.jwt, peer.userId, 'guest');
+    expect(attack.status, 'a host must not be able to demote a peer host').toBe(403);
+
+    // An admin may still demote a host.
+    const byAdmin = await patchRole(adminToken, peer.userId, 'guest');
+    expect(byAdmin.status).toBe(204);
+
+    // A host may still manage guests (promote one to host).
+    const promote = await patchRole(host.jwt, plain.userId, 'host');
+    expect(promote.status).toBe(204);
+  });
+});