fix(security): high — live authz, XFF, SSE buffering, atomicity, pagination

H1: auth extractor re-reads the live user row — trusts the DB role (not the
    JWT claim) and rejects banned users mid-session. e2e proves a demoted
    host loses powers and a banned host is locked out and can't self-unban.
H2: client_ip takes the right-most XFF hop (the one Caddy appends); spoofed
    left-most entries are ignored, restoring IP-based throttles.
H3: Caddy excludes /api/v1/stream from `encode` so SSE isn't buffered.
H4: upload — quota increment + row insert + hashtag links now one txn.
H5: feed keyset pagination tiebroken on (created_at, id) + composite index
    (migration 010); feed_delta bounded with LIMIT.
H7: LightboxModal keys its comment load off upload.id, ending the
    SSE-driven refetch storm.
H8: CSP via SvelteKit kit.csp (svelte.config.js) hardens the localStorage
    token model against injection.

Migration 010 also adds the latent comment/comment_hashtag indexes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/specs/04-host/moderation.spec.ts

@@ -45,3 +45,54 @@ test.describe('Host — moderation API', () => {
     expect(row?.role).toBe('host');
   });
 });
+
+/**
+ * Regression for the review's H1: role & ban used to be trusted from the JWT and
+ * never re-checked against the DB, so a demoted/banned host kept full powers for
+ * the life of their token (up to 30d) and a banned host could even unban
+ * themselves. The auth extractor now re-reads the live user row, so these take
+ * effect on the *existing* session with no re-login.
+ */
+test.describe('Host — live role/ban revocation (H1)', () => {
+  test('a demoted host loses host powers on their existing session', async ({
+    api,
+    adminToken,
+    guest,
+  }) => {
+    const u = await guest('DemoteMidSession');
+    await api.setRole(adminToken, u.userId, 'host');
+    // Fresh host token (role is encoded at mint time).
+    const { body } = await api.recover(u.displayName, u.pin);
+    const hostJwt = body.jwt;
+
+    // Sanity: the token currently has host powers.
+    await api.listUsers(hostJwt);
+
+    // Demote via admin — the host does NOT re-login.
+    await api.setRole(adminToken, u.userId, 'guest');
+
+    // Same token is now rejected because the middleware trusts the DB role.
+    await expect(api.listUsers(hostJwt)).rejects.toThrow();
+  });
+
+  test('a banned host is locked out immediately on their existing session', async ({
+    api,
+    adminToken,
+    host,
+  }) => {
+    // Sanity: host token works.
+    await api.listUsers(host.jwt);
+
+    await api.banUser(adminToken, host.userId, false);
+
+    // Banned users are rejected by the auth extractor before any handler runs.
+    await expect(api.listUsers(host.jwt)).rejects.toThrow();
+  });
+
+  test('a banned host cannot unban themselves', async ({ api, adminToken, host }) => {
+    await api.banUser(adminToken, host.userId, false);
+    await expect(
+      api.unbanUser(host.jwt, host.userId, { expectedStatus: [204] })
+    ).rejects.toThrow();
+  });
+});