feat(eventsnap): UX review batch-3 — feed virtualization, a11y/UX fixes, shared primitives

Frontend
- Feed: DOM-windowing via @tanstack/svelte-virtual (new VirtualFeed). The window
  virtualizer keeps the sticky header, pull-to-refresh, infinite-scroll sentinel and
  bottom nav working. List = dynamic measured heights keyed by upload id +
  anchorTo:start so an SSE prepend doesn't jump a scrolled reader; grid = measured
  square rows. Drops the content-visibility band-aid and the old FeedGrid.
  measureElement(null) on row unmount prevents ResizeObserver retention; stable
  option callbacks + guarded setOptions avoid O(n) re-measure on like/comment patches.
- Global: viewport-fit=cover (activates safe-area insets), lang=de, PWA manifest +
  maskable icon + apple-touch metas, prefers-reduced-motion, safe-area-top headers.
- Feed reactivity: like/comment SSE patch the single card in place; upload-processed
  debounced in-place merge; IntersectionObserver leak fixed; shared 60s clock.
- CLS: list cards reserve the skeleton aspect box.
- Destructive actions (promote/demote/unban, gallery release) routed through
  ConfirmSheet (host + admin).
- Export OOM: streamed download via single-use ticket instead of res.blob().
- Shared primitives: IconButton (44px hit area), scrollLock action; UploadSheet a11y.
- Polish: api timeout + non-JSON guard, focus-trap offsetParent fix, pull-to-refresh
  passive:false + guards, diashow keyboard a11y, Toaster assertive errors, dark-mode
  gaps, aria-pressed on like/chip state, CameraCapture mic-on-video + retry,
  ConfirmSheet spinner, upload beforeunload warning, emoji->SVG icons.

Backend
- social.rs: like/comment SSE broadcasts now carry the fresh count so feed clients
  patch one card in place instead of refetching page 1.
- admin.rs / main.rs: supporting changes for the above.

Verified: svelte-check 0 errors, frontend build clean, /feed SSR 200. Runtime feed
scroll-feel validation still owed (documented in FOLLOWUPS.md).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/handlers/social.rs

@@ -43,10 +43,18 @@ pub async fn toggle_like(
             .await?;
     }
 
+    // Fresh count so feed clients can patch the single card in place instead of
+    // refetching page 1 (mirrors v_feed.like_count = COUNT(DISTINCT user_id)).
+    let like_count: i64 =
+        sqlx::query_scalar("SELECT COUNT(DISTINCT user_id) FROM \"like\" WHERE upload_id = $1")
+            .bind(upload_id)
+            .fetch_one(&state.pool)
+            .await?;
+
     // Broadcast SSE
     let _ = state.sse_tx.send(crate::state::SseEvent {
         event_type: "like-update".to_string(),
-        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+        data: serde_json::json!({ "upload_id": upload_id, "like_count": like_count }).to_string(),
     });
 
     Ok(StatusCode::NO_CONTENT)
@@ -114,10 +122,20 @@ pub async fn add_comment(
         .await?;
     }
 
+    // Fresh count so feed clients can patch the single card in place instead of
+    // refetching page 1 (mirrors v_feed.comment_count = COUNT(DISTINCT c.id)).
+    let comment_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM comment WHERE upload_id = $1 AND deleted_at IS NULL",
+    )
+    .bind(upload_id)
+    .fetch_one(&state.pool)
+    .await?;
+
     // Broadcast SSE
     let _ = state.sse_tx.send(crate::state::SseEvent {
         event_type: "new-comment".to_string(),
-        data: serde_json::json!({ "upload_id": upload_id }).to_string(),
+        data: serde_json::json!({ "upload_id": upload_id, "comment_count": comment_count })
+            .to_string(),
     });
 
     let dto = CommentDto {