perf(backend): close config/upload/export hot paths + stability fixes

Performance:
- Cache the runtime `config` table in-memory (ConfigCache) with synchronous
  invalidation on every write (admin PATCH + test reseed). Was re-reading each
  key from Postgres on every request (~8 round-trips per upload).
- Stream uploads chunk-by-chunk to a temp file instead of buffering the whole
  body in RAM (peak was up to the per-class cap, e.g. 500 MB/video); only 512
  sniff-bytes are kept for magic-byte detection, then atomic rename into place.
- Cache the media-filesystem disk snapshot (DiskCache, 15s TTL) shared by the
  quota check and admin stats; drop the discarded System::refresh_all().
- HTML export streams video (and small-image) originals straight into the ZIP
  via a manifest instead of copying them to a temp dir first (removed the
  transient 2x disk usage) and drops the double directory scan.
- Auth extractor resolves session -> live user in one JOIN (was two queries),
  touching last_seen_at by token hash.

Stability:
- SSE: on broadcast lag, emit a `resync` event so the client runs a delta
  fetch instead of silently losing events; frontend reconciles adds, deletions,
  and (via an in-place refresh) like/comment counts on visible cards.
- Storage quota fails OPEN when the disk can't be read (was a 0-byte limit that
  locked out all uploads).
- Graceful shutdown drains in-flight requests on SIGTERM/SIGINT, bounded by a
  10s backstop so open SSE streams can't stall a deploy.
- Upload removes the persisted file if the DB transaction fails (no orphaned
  bytes with no row to reclaim them).

Tests:
- New pure select_disk() with 5 unit tests (longest-prefix, fallbacks, fail-open).
- New e2e export-video spec covering the HTML export's video-streaming branch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/models/session.rs

@@ -43,9 +43,33 @@ impl Session {
         .await
     }
 
-    pub async fn touch(pool: &PgPool, id: Uuid) -> Result<(), sqlx::Error> {
-        sqlx::query("UPDATE session SET last_seen_at = NOW() WHERE id = $1")
-            .bind(id)
+    /// Resolve a session token straight to its live user row in one round-trip.
+    ///
+    /// The auth extractor runs on every authenticated request and used to do two
+    /// sequential queries (session lookup, then user lookup); this collapses them into
+    /// a single `session JOIN "user"`. The `expires_at` guard mirrors
+    /// [`Self::find_by_token_hash`], and the user row is read live (role/ban are never
+    /// trusted from the JWT). Returns `None` when the session is missing/expired.
+    pub async fn find_user_by_token_hash(
+        pool: &PgPool,
+        token_hash: &str,
+    ) -> Result<Option<crate::models::user::User>, sqlx::Error> {
+        sqlx::query_as::<_, crate::models::user::User>(
+            "SELECT u.*
+             FROM session s
+             JOIN \"user\" u ON u.id = s.user_id
+             WHERE s.token_hash = $1 AND s.expires_at > NOW()",
+        )
+        .bind(token_hash)
+        .fetch_optional(pool)
+        .await
+    }
+
+    /// Update `last_seen_at`, keyed by the token hash so the auth extractor can touch a
+    /// session without a separate query to fetch its id first.
+    pub async fn touch_by_token_hash(pool: &PgPool, token_hash: &str) -> Result<(), sqlx::Error> {
+        sqlx::query("UPDATE session SET last_seen_at = NOW() WHERE token_hash = $1")
+            .bind(token_hash)
             .execute(pool)
             .await?;
         Ok(())