fix(review-2): medium/low + docs — config validation, hygiene, doc sync

- compression_concurrency wired to boot config (state.rs) and removed as a
  dead admin control.
- patch_config gains per-key integer/range validation so numerically-valid-but-
  nonsensical values (-1/NaN/3.5) are rejected instead of silently reverting to
  default at read time.
- clearAuth now also clears the display name (shared-device residual).
- e2e/Caddyfile.test mirrors prod security headers + the SSE encode-exclusion so
  the test stack is representative and can catch header regressions.
- .gitignore: ignore root-level Playwright artifacts (test-results/, report).
- docs: USER_JOURNEYS §10 and SECURITY-BACKLOG updated to match the implemented
  read-only-ban behavior and the export-path fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/helpers/seed.ts

@@ -3,11 +3,26 @@
  * flow. Centralising the API contract (routes, field names, expected statuses)
  * means an API change is a one-file edit, not a 7-file hunt.
  */
-import { uploadRaw, JPEG_MAGIC } from './upload-client';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { uploadRaw } from './upload-client';
 import { db } from '../fixtures/db';
 
 const BASE = process.env.E2E_FRONTEND_URL ?? 'http://localhost:3101';
 
+// A real, decodable JPEG. Magic-bytes-only fakes now get auto-cleaned by the
+// backend when compression fails (a failed transcode refunds quota + deletes the
+// row), which would delete the seeded upload out from under the test. Read lazily
+// at call time (cwd is the e2e dir at runtime, like the gallery-path spec) so test
+// collection can't trip on a module-load read.
+let sampleJpg: Buffer | null = null;
+function sampleImage(): Buffer {
+  if (!sampleJpg) {
+    sampleJpg = readFileSync(join(process.cwd(), 'fixtures', 'media', 'sample.jpg'));
+  }
+  return sampleJpg;
+}
+
 export type SeedUploadOptions = {
   caption?: string;
   /** Mark compression done so the card is fully rendered in the feed. Default true. */
@@ -16,9 +31,7 @@ export type SeedUploadOptions = {
 
 /** Seed a real, accepted upload owned by `jwt` and return its id. */
 export async function seedUpload(jwt: string, opts: SeedUploadOptions = {}): Promise<string> {
-  const body = new Uint8Array(1024);
-  body.set(JPEG_MAGIC, 0);
-  const res = await uploadRaw(jwt, body, {
+  const res = await uploadRaw(jwt, sampleImage(), {
     filename: 'a.jpg',
     contentType: 'image/jpeg',
     caption: opts.caption,