perf(backend): close config/upload/export hot paths + stability fixes

Performance:
- Cache the runtime `config` table in-memory (ConfigCache) with synchronous
  invalidation on every write (admin PATCH + test reseed). Was re-reading each
  key from Postgres on every request (~8 round-trips per upload).
- Stream uploads chunk-by-chunk to a temp file instead of buffering the whole
  body in RAM (peak was up to the per-class cap, e.g. 500 MB/video); only 512
  sniff-bytes are kept for magic-byte detection, then atomic rename into place.
- Cache the media-filesystem disk snapshot (DiskCache, 15s TTL) shared by the
  quota check and admin stats; drop the discarded System::refresh_all().
- HTML export streams video (and small-image) originals straight into the ZIP
  via a manifest instead of copying them to a temp dir first (removed the
  transient 2x disk usage) and drops the double directory scan.
- Auth extractor resolves session -> live user in one JOIN (was two queries),
  touching last_seen_at by token hash.

Stability:
- SSE: on broadcast lag, emit a `resync` event so the client runs a delta
  fetch instead of silently losing events; frontend reconciles adds, deletions,
  and (via an in-place refresh) like/comment counts on visible cards.
- Storage quota fails OPEN when the disk can't be read (was a 0-byte limit that
  locked out all uploads).
- Graceful shutdown drains in-flight requests on SIGTERM/SIGINT, bounded by a
  10s backstop so open SSE streams can't stall a deploy.
- Upload removes the persisted file if the DB transaction fails (no orphaned
  bytes with no row to reclaim them).

Tests:
- New pure select_disk() with 5 unit tests (longest-prefix, fallbacks, fail-open).
- New e2e export-video spec covering the HTML export's video-streaming branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/auth/handlers.rs

@@ -37,8 +37,8 @@ pub async fn join(
     Json(body): Json<JoinRequest>,
 ) -> Result<(StatusCode, Json<JoinResponse>), AppError> {
     let ip = client_ip(&headers, "unknown");
-    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
-    let join_rate_on = config::get_bool(&state.pool, "join_rate_enabled", true).await;
+    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
+    let join_rate_on = config::get_bool(&state.config_cache, "join_rate_enabled", true).await;
     if rate_limits_on && join_rate_on
         && !state.rate_limiter.check(format!("join:{ip}"), 5, Duration::from_secs(60))
     {
@@ -134,8 +134,8 @@ pub async fn recover(
     // every 15 minutes, indefinitely. 5 attempts per 15 minutes per (IP, name)
     // softens that into a real cost.
     let ip = client_ip(&headers, "unknown");
-    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
-    let recover_rate_on = config::get_bool(&state.pool, "recover_rate_enabled", true).await;
+    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
+    let recover_rate_on = config::get_bool(&state.config_cache, "recover_rate_enabled", true).await;
     if rate_limits_on && recover_rate_on {
         let name_key = display_name.to_lowercase();
         if !state.rate_limiter.check(
@@ -260,8 +260,8 @@ pub async fn admin_login(
     // a long-running guess campaign. 5 attempts / minute / IP is plenty for
     // honest typos.
     let ip = client_ip(&headers, "unknown");
-    let rate_limits_on = config::get_bool(&state.pool, "rate_limits_enabled", true).await;
-    let admin_rate_on = config::get_bool(&state.pool, "admin_login_rate_enabled", true).await;
+    let rate_limits_on = config::get_bool(&state.config_cache, "rate_limits_enabled", true).await;
+    let admin_rate_on = config::get_bool(&state.config_cache, "admin_login_rate_enabled", true).await;
     if rate_limits_on && admin_rate_on
         && !state.rate_limiter.check(
             format!("admin_login:{ip}"),

backend/src/auth/middleware.rs

@@ -37,34 +37,32 @@ impl FromRequestParts<AppState> for AuthUser {
             .strip_prefix("Bearer ")
             .ok_or_else(|| AppError::Unauthorized("Ungültiges Token-Format.".into()))?;
 
-        let claims = jwt::verify_token(token, &state.config.jwt_secret)
+        // Verify the JWT (signature + expiry). We deliberately do NOT trust its role/ban
+        // claims — the live user row below is authoritative — so the decoded claims
+        // themselves aren't needed beyond this check.
+        jwt::verify_token(token, &state.config.jwt_secret)
             .map_err(|_| AppError::Unauthorized("Token ungültig oder abgelaufen.".into()))?;
 
         let token_hash = jwt::hash_token(token);
 
-        let session = Session::find_by_token_hash(&state.pool, &token_hash)
+        // Single round-trip: resolve the session token to its *live* user row. A
+        // role/ban stored in the token would survive a demote/ban for the full session
+        // lifetime (up to 30d), so we always re-read the user (a demoted host loses host
+        // powers immediately). We do NOT reject banned users here — they retain read
+        // access by design; writes and host/admin actions enforce the ban downstream.
+        let user = Session::find_user_by_token_hash(&state.pool, &token_hash)
             .await
             .map_err(|e| AppError::Internal(e.into()))?
             .ok_or_else(|| AppError::Unauthorized("Sitzung nicht gefunden oder abgelaufen.".into()))?;
 
-        // Trust *live* DB state, not the JWT: a role/ban stored in the token would
-        // survive a demote/ban for the full session lifetime (up to 30d). Re-read
-        // the user row so a demoted host loses host powers immediately. We do NOT
-        // reject banned users here — they retain read access by design; writes and
-        // host/admin actions enforce the ban downstream.
-        let user = crate::models::user::User::find_by_id(&state.pool, claims.sub)
-            .await
-            .map_err(|e| AppError::Internal(e.into()))?
-            .ok_or_else(|| AppError::Unauthorized("Benutzer nicht gefunden.".into()))?;
-
         // Update last_seen_at in the background (fire-and-forget). Failures are
         // non-fatal but worth surfacing — silent swallowing hides DB connection
         // pressure that would otherwise be the first symptom of a real problem.
         let pool = state.pool.clone();
-        let session_id = session.id;
+        let touch_hash = token_hash.clone();
         tokio::spawn(async move {
-            if let Err(e) = Session::touch(&pool, session_id).await {
-                tracing::warn!(error = ?e, session_id = %session_id, "session touch failed");
+            if let Err(e) = Session::touch_by_token_hash(&pool, &touch_hash).await {
+                tracing::warn!(error = ?e, "session touch failed");
             }
         });