fix(rereview): close residual export finalize↔flip double-race at reopen

Adversarial re-review of df275bb found the two-guard ready-flip fix still left a
narrow double-race open, plus test-hygiene drift from the banUser param removal.

MED — residual stale-keepsake race the `export_released_at` guard alone missed
  The flip relied on two guards defeating two clearers: the `release_seq` EXISTS
  check (vs a re-release bump) and `export_released_at IS NOT NULL` (vs open_event's
  clear). But release_gallery re-arms `export_released_at = NOW()` and bumps
  `release_seq` as SEPARATE statements, so a stale worker's flip landing in the gap
  between them satisfies BOTH guards (released re-armed, seq not yet bumped) and
  resurrects a pre-reopen keepsake — the next re-release then skips regeneration and
  serves an archive missing the reopen-window uploads.

  Root-cause fix: `open_event` now bumps every `export_job.release_seq`, making a
  reopen a supersession point symmetric with a re-release. A worker that captured the
  pre-reopen seq can never match its `release_seq`-guarded finalize/flip again,
  regardless of when the re-release re-arms `export_released_at`. The released-anchor
  guard stays as defense-in-depth. Added a deterministic e2e asserting the reopen
  bumps the seq (the invariant that closes the race without depending on
  sub-millisecond worker timing).

LOW
  - Gate the `export-progress: 100` SSE + `prune_stale_export_files` on the ready-flip
    actually flipping (rows_affected > 0). A superseded worker no longer advertises a
    misleading 100% or prunes on a fresh generation's behalf.
  - moderation.spec.ts: the two ban tests had become byte-identical after the
    hide_uploads param removal; drop the one whose "hide_uploads=true" title no longer
    matched what it exercised, keep the accurate "always hides" test.
  - host-dashboard page-object: drop the dead `banUser(hideUploads)` param + its
    checkbox branch (the UI no longer renders that checkbox — a latent hang trap).
  - sse-eviction.spec.ts: rename the test whose title referenced the removed flag.

Verified: backend 40 tests, e2e 156 passed / 1 skipped on chromium-desktop
(incl. the new reopen-supersession regression).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/moderation.spec.ts

@@ -7,18 +7,9 @@ import { test, expect } from '../../fixtures/test';
 import { seedUpload, seedComment } from '../../helpers/seed';
 
 test.describe('Host — moderation API', () => {
-  test('ban with hide_uploads=true sets the right flags', async ({ api, host, guest }) => {
-    const target = await guest('Banned1');
-    await api.banUser(host.jwt, target.userId);
-    const users = await api.listUsers(host.jwt);
-    const row = users.find((u: any) => u.id === target.userId);
-    expect(row?.is_banned).toBe(true);
-    expect(row?.uploads_hidden).toBe(true);
-  });
-
-  test('ban always hides — the hide_uploads flag is ignored (USER_JOURNEYS §10.5)', async ({ api, host, guest }) => {
-    // Ban is now unconditionally a hide: even asking NOT to hide still hides, because a
-    // banned user's content is "gone" everywhere. The legacy hide_uploads arg is ignored.
+  test('ban always hides — a banned user is is_banned AND uploads_hidden (USER_JOURNEYS §9.5)', async ({ api, host, guest }) => {
+    // Ban is unconditionally a hide: a banned user's content is "gone" everywhere. The endpoint
+    // takes no body and there is no per-request opt-out (the legacy hide_uploads flag is gone).
     const target = await guest('Banned2');
     await api.banUser(host.jwt, target.userId);
     const users = await api.listUsers(host.jwt);

e2e/specs/04-host/sse-eviction.spec.ts

@@ -30,7 +30,7 @@ test.describe('Host — live SSE eviction (H3)', () => {
     );
   });
 
-  test('banning a user with hide_uploads broadcasts user-hidden', async ({
+  test('banning a user broadcasts user-hidden', async ({
     api,
     host,
     guest,