Harden sessions, uploads, admin demotion, and HTTP timeouts.

Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.

cmd/server/main.go

@@ -29,7 +29,14 @@ func main() {
 
 	uploader := blob.FromEnv()
 	handler := newHandler(db, sessions, uploader)
-	run(&http.Server{Addr: listenAddr(), Handler: handler})
+	run(&http.Server{
+		Addr:              listenAddr(),
+		Handler:           handler,
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       90 * time.Second,
+	})
 }
 
 func openDB() (*sql.DB, *store.SessionStore) {