fix(security): cross-event authz, SSE ticket flow, account hardening, audit logs

Follow-up to the comprehensive code review. Five batches:

1. Cross-event authorization: host_delete_upload, unban_user, and
   host_delete_comment now scope by auth.event_id. Adds
   Upload::find_by_id_and_event / soft_delete_in_event and a
   Comment::soft_delete_in_event variant that joins through upload.

2. Token exposure: SSE auth no longer puts the JWT in the URL.
   New /api/v1/stream/ticket endpoint mints a short-lived single-use
   ticket bound to the session; the EventSource passes ?ticket=...
   instead. Refuse to start in APP_ENV=production with the dev JWT
   sentinel; warn loudly otherwise.

3. Account hardening: per-IP+name rate limit on /recover (mitigates
   targeted lockout DoS), per-IP rate limit on /admin/login, random
   32-char admin recovery PIN (replaces "0000"), structured tracing
   events for wrong PIN, lockout, failed admin login, ban/unban/role
   change/pin-reset/host-delete.

4. DoS / correctness: comment listing paginated (LIMIT 50 + ?before=
   cursor), hashtag extraction whitelisted to ASCII alnum+underscore
   (≤40 chars) with unit tests, display_name / caption / comment body
   length validated in chars rather than bytes.

5. Cleanup: session-touch failures now logged, DATABASE_MAX_CONNECTIONS
   env var (default 10).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/models/upload.rs

@@ -69,6 +69,23 @@ impl Upload {
         .await
     }
 
+    /// Event-scoped lookup used by host endpoints so a host of event A cannot
+    /// reach uploads belonging to event B.
+    pub async fn find_by_id_and_event(
+        pool: &PgPool,
+        id: Uuid,
+        event_id: Uuid,
+    ) -> Result<Option<Self>, sqlx::Error> {
+        sqlx::query_as::<_, Self>(
+            "SELECT * FROM upload
+             WHERE id = $1 AND event_id = $2 AND deleted_at IS NULL",
+        )
+        .bind(id)
+        .bind(event_id)
+        .fetch_optional(pool)
+        .await
+    }
+
     pub async fn set_preview_path(
         pool: &PgPool,
         id: Uuid,
@@ -128,6 +145,43 @@ impl Upload {
         Ok(())
     }
 
+    /// Event-scoped variant of [`Self::soft_delete`]. Returns `false` if no row
+    /// matched (already deleted, wrong event, or unknown id) so host handlers
+    /// can return a clean 404 instead of silently no-op'ing.
+    pub async fn soft_delete_in_event(
+        pool: &PgPool,
+        id: Uuid,
+        event_id: Uuid,
+    ) -> Result<bool, sqlx::Error> {
+        let mut tx = pool.begin().await?;
+        let row: Option<(Uuid, i64)> = sqlx::query_as(
+            "UPDATE upload
+             SET deleted_at = NOW()
+             WHERE id = $1 AND event_id = $2 AND deleted_at IS NULL
+             RETURNING user_id, original_size_bytes",
+        )
+        .bind(id)
+        .bind(event_id)
+        .fetch_optional(&mut *tx)
+        .await?;
+        let deleted = if let Some((user_id, bytes)) = row {
+            sqlx::query(
+                "UPDATE \"user\"
+                 SET total_upload_bytes = GREATEST(0, total_upload_bytes - $2)
+                 WHERE id = $1",
+            )
+            .bind(user_id)
+            .bind(bytes)
+            .execute(&mut *tx)
+            .await?;
+            true
+        } else {
+            false
+        };
+        tx.commit().await?;
+        Ok(deleted)
+    }
+
     pub async fn update_caption(
         pool: &PgPool,
         id: Uuid,