fix(security): harden authz, media gating, recover, SSE, deps

Security audit follow-up. No Critical/High existed; these close the
Medium/Low findings.

F1 [Med] Host privilege boundary: a host could demote a peer host to
  guest and then ban / PIN-reset (→ account takeover via /recover) them,
  because the ban/pin-reset peer guards key off the target's *current*
  role. set_role now blocks a non-admin from demoting a host.

F2 [Med] Moderation now revokes preview/thumbnail access: they are served
  through visibility-checked aliases (/api/v1/upload/{id}/{preview,
  thumbnail}) that filter soft-deleted / ban-hidden uploads, and direct
  /media/previews|thumbnails is 404-blocked. Feed emits the gated URLs;
  Caddy keeps them privately cacheable (max-age=300, short so moderation
  revokes promptly — the live feed already evicts cards via SSE). Uses a
  lean find_visible_media() (paths+mime only) on the media hot path.

F3 [Med/Low] npm audit fix: svelte 5.55.1→5.56.4 (SSR-XSS advisories),
  devalue 5.6.4→5.8.1 (DoS). Prod deps: 0 vulnerabilities.

F4 [Low] /recover no longer leaks account existence: unknown display name
  returns the same 401 as a wrong PIN, and runs a dummy bcrypt verify so
  timing matches — closing the enumeration + timing oracle.

F5 [Low] SSE streams re-validate the session every ~60s and close once it
  is logged out / expired, instead of running until client disconnect.

F6 [Info] X-Content-Type-Options: nosniff set at the app layer on all
  media responses (defense-in-depth alongside the edge).

Tests: new e2e specs for F1 (host cannot demote peer host), F2 (preview
gated + 404 after delete + direct /media blocked), F4 (uniform 401).
40 backend unit tests + 182 e2e passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/data-mode-store.test.ts

@@ -3,8 +3,8 @@ import { pickMediaUrl } from './data-mode-store';
 
 const upload = {
   id: 'abc-123',
-  preview_url: '/media/previews/p.jpg',
-  thumbnail_url: '/media/thumbnails/t.jpg',
+  preview_url: '/api/v1/upload/abc-123/preview',
+  thumbnail_url: '/api/v1/upload/abc-123/thumbnail',
 };
 
 describe('pickMediaUrl', () => {
@@ -13,11 +13,13 @@ describe('pickMediaUrl', () => {
   });
 
   it('saver mode → preview_url when present', () => {
-    expect(pickMediaUrl('saver', upload)).toBe('/media/previews/p.jpg');
+    expect(pickMediaUrl('saver', upload)).toBe('/api/v1/upload/abc-123/preview');
   });
 
   it('saver mode → thumbnail_url when preview is null', () => {
-    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe('/media/thumbnails/t.jpg');
+    expect(pickMediaUrl('saver', { ...upload, preview_url: null })).toBe(
+      '/api/v1/upload/abc-123/thumbnail'
+    );
   });
 
   it('saver mode → original route when both preview and thumbnail are null', () => {