fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931) (stable) (#934)

* fix(uploads): prevent cross-photo contamination from filename collisions and non-atomic writes (#931)

* test: pin the suffixed photo filename format in the NFD pipeline suite (#931)

* chore(deps): promote p-limit to a direct dependency for the watermark limiter (#931)

* test: make the suffix-uniqueness check deterministic-in-practice (#931)

* fix(uploads): widen the anti-collision suffix to 48 bits (#931)

* fix(uploads): hide staging files from list() + share one watermark limiter process-wide (#931)

* fix(uploads): reclaim orphaned staging files + revalidate watermark settings in queued jobs (#931)

---------

Co-authored-by: Paul Nothaft <[email protected]>

backend/src/routes/adminPhotos.js

@@ -315,9 +315,10 @@ router.post('/:eventId/upload', adminAuth, requirePermission('photos.upload'), r
     const crypto = require('crypto');
     const uploadId = crypto.randomBytes(16).toString('hex');
 
-    // Counter base — same approximation as before. Strict uniqueness is
-    // already enforced by the filename template + DB unique index, so a
-    // small race here just retries a counter on conflict (rare).
+    // Counter base — a per-request approximation (concurrent upload
+    // requests can compute the same base; there is NO unique index on
+    // photos.filename). Uniqueness of the final path comes from the
+    // random suffix inside generatePhotoFilename (#931).
     const existingCount = await db('photos')
       .where({ event_id: eventId, type: photoType })
       .count('id as count')