test(e2e): address self-review follow-ups (dedup, XSS render guard, SSE hardening)

Follow-ups from the code review of the test-quality batches:

- Consolidate duplicated helpers into e2e/helpers/: seed.ts (seedUpload,
  seedComment, listComments, findFeedRow) and sse.ts (mintSseTicket, openStream,
  trackStreamOpens). Refactor authorization-deep, xss-injection, like-comment,
  sse-ticket-abuse, ddos, sse-realtime, multi-tab, and SseListener to use them —
  the upload/comment/ticket-flow contracts now live in one place each instead of
  being re-inlined across 3–7 specs.
- xss-injection display-name loop: it navigated to /feed (which renders uploader
  names, not the viewer's) so "nothing fired" passed vacuously — the payload was
  never rendered. Now navigate to /account (the actual sink) and add a render
  guard asserting the payload reached the DOM as escaped text before checking
  __xssFired.
- sse-realtime reconnect: snapshot the stream-open count AFTER backgrounding, so
  the "new connection" assertion is attributable to the foreground event and can't
  be satisfied by a spurious native/error reconnect before the toggle.
- recover-page: correct the comment (auto-submit is the onPinInput handler, not an
  $effect).

44 affected specs verified green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/03-feed/like-comment.spec.ts

@@ -7,20 +7,10 @@
  */
 import { test, expect } from '../../fixtures/test';
 import { SseListener } from '../../helpers/sse-listener';
-import { uploadRaw, JPEG_MAGIC } from '../../helpers/upload-client';
+import { seedUpload, seedComment, findFeedRow } from '../../helpers/seed';
 
 const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 
-async function seedUpload(jwt: string, db: any, caption?: string): Promise<string> {
-  const body = new Uint8Array(1024);
-  body.set(JPEG_MAGIC, 0);
-  const res = await uploadRaw(jwt, body, { filename: 'a.jpg', contentType: 'image/jpeg', caption });
-  if (res.status !== 201) throw new Error(`seed upload failed: ${res.status} ${await res.text()}`);
-  const { id } = await res.json();
-  await db.setUploadCompressionStatus(id, 'done');
-  return id;
-}
-
 async function like(jwt: string, uploadId: string): Promise<number> {
   const res = await fetch(`${BASE}/api/v1/upload/${uploadId}/like`, {
     method: 'POST',
@@ -29,43 +19,38 @@ async function like(jwt: string, uploadId: string): Promise<number> {
   return res.status;
 }
 
-function findRow(feed: any, id: string): any {
-  const list: any[] = feed.uploads ?? feed.items ?? feed;
-  return list.find((u: any) => u.id === id);
-}
-
 test.describe('Feed — like + comment', () => {
-  test('a like counts once per user and toggles off on repeat (no double-count)', async ({ api, guest, db }) => {
+  test('a like counts once per user and toggles off on repeat (no double-count)', async ({ api, guest }) => {
     const author = await guest('Author');
     const liker = await guest('Liker');
-    const uploadId = await seedUpload(author.jwt, db);
+    const uploadId = await seedUpload(author.jwt);
 
     // Baseline: nobody has liked yet.
-    let row = findRow(await api.getFeed(liker.jwt), uploadId);
+    let row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(0);
     expect(row.liked_by_me).toBe(false);
 
     // First like → counted exactly once.
     expect(await like(liker.jwt, uploadId)).toBe(204);
-    row = findRow(await api.getFeed(liker.jwt), uploadId);
+    row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(1);
     expect(row.liked_by_me).toBe(true);
 
     // Liking again is a toggle → back to zero (guards against a regression that
     // double-counts a repeated like instead of removing it).
     expect(await like(liker.jwt, uploadId)).toBe(204);
-    row = findRow(await api.getFeed(liker.jwt), uploadId);
+    row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(0);
     expect(row.liked_by_me).toBe(false);
 
     // A second distinct user's like is counted independently (per-user semantics).
     expect(await like(liker.jwt, uploadId)).toBe(204); // liker likes again → 1
     expect(await like(author.jwt, uploadId)).toBe(204); // author likes too → 2
-    row = findRow(await api.getFeed(liker.jwt), uploadId);
+    row = findFeedRow(await api.getFeed(liker.jwt), uploadId);
     expect(row.like_count).toBe(2);
   });
 
-  test('comment by user A → SSE new-comment delivered to user B', async ({ guest, db }) => {
+  test('comment by user A → SSE new-comment delivered to user B', async ({ guest }) => {
     // SSE frames can take a keep-alive tick to flush through the reverse proxy, so
     // both the stream connect and the delivery may cost up to ~30s each.
     test.setTimeout(120_000);
@@ -77,13 +62,8 @@ test.describe('Feed — like + comment', () => {
     await sse.start(b.jwt);
 
     try {
-      const uploadId = await seedUpload(a.jwt, db, 'pic');
-      const cRes = await fetch(`${BASE}/api/v1/upload/${uploadId}/comments`, {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${a.jwt}`, 'Content-Type': 'application/json' },
-        body: JSON.stringify({ body: 'hello from A' }),
-      });
-      expect(cRes.status).toBe(201);
+      const uploadId = await seedUpload(a.jwt, { caption: 'pic' });
+      await seedComment(a.jwt, uploadId, 'hello from A');
 
       // B must receive the new-comment event for this upload. Generous timeout: SSE
       // frames flush on the keep-alive tick through the compressing reverse proxy.