Harden sessions, uploads, admin demotion, and HTTP timeouts.

Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.

internal/store/sessions_test.go

@@ -9,10 +9,7 @@ import (
 func TestSessionStoreCommitFindDelete(t *testing.T) {
 	url := os.Getenv("TEST_DATABASE_URL")
 	if url == "" {
-		url = os.Getenv("DATABASE_URL")
-	}
-	if url == "" {
-		t.Skip("DATABASE_URL or TEST_DATABASE_URL not set")
+		t.Skip("TEST_DATABASE_URL not set")
 	}
 	schema, err := os.ReadFile("../../schema.sql")
 	if err != nil {

internal/store/user.go

@@ -92,6 +92,10 @@ func (u *User) Create(ctx context.Context) error {
 	})
 }
 
+// adminRoleLockKey serializes SetRole so concurrent demotions cannot bypass the
+// last-admin guard under READ COMMITTED.
+const adminRoleLockKey int64 = 0x706c756d5f61646d // "plum_adm"
+
 // SetRole updates this user's role (last-admin safe).
 func (u *User) SetRole(ctx context.Context, role Role) error {
 	if u == nil || u.db == nil {
@@ -106,6 +110,10 @@ func (u *User) SetRole(ctx context.Context, role Role) error {
 	}
 	defer tx.Rollback()
 
+	if _, err := tx.ExecContext(ctx, `SELECT pg_advisory_xact_lock($1)`, adminRoleLockKey); err != nil {
+		return err
+	}
+
 	q := sqlc.New(tx)
 	current, err := q.GetUserRole(ctx, u.ID)
 	if err != nil {