Harden sessions, uploads, admin demotion, and HTTP timeouts.

Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.

internal/web/auth.go

@@ -54,6 +54,10 @@ func (s *Server) handleLogin(w http.ResponseWriter, r *http.Request) {
 		})
 		return
 	}
+	if err := s.sessions.RenewToken(r.Context()); err != nil {
+		http.Error(w, "could not start session", http.StatusInternalServerError)
+		return
+	}
 	s.sessions.Put(r.Context(), "user_id", u.ID)
 	http.Redirect(w, r, next, http.StatusSeeOther)
 }
@@ -108,6 +112,10 @@ func (s *Server) handleRegister(w http.ResponseWriter, r *http.Request) {
 		s.exec(w, "register", p)
 		return
 	}
+	if err := s.sessions.RenewToken(r.Context()); err != nil {
+		http.Error(w, "could not start session", http.StatusInternalServerError)
+		return
+	}
 	s.sessions.Put(r.Context(), "user_id", u.ID)
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }