Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

cmd/server/main.go

@@ -7,7 +7,9 @@ import (
 	"git.misaka.ren/m1saka/dsh-web/internal/api"
 	"git.misaka.ren/m1saka/dsh-web/internal/store"
 	"golang.org/x/crypto/bcrypt"
+	"io"
 	"log"
+	"net"
 	"net/http"
 	"os"
 	"os/signal"
@@ -18,10 +20,37 @@ import (
 )
 
 func main() {
+	if len(os.Args) > 1 && os.Args[1] == "-healthcheck" {
+		if err := healthcheck(); err != nil {
+			log.Printf("healthcheck failed: %v", err)
+			os.Exit(1)
+		}
+		return
+	}
 	if err := run(); err != nil {
 		log.Fatal(err)
 	}
 }
+
+// healthcheck probes the local /healthz endpoint for container health
+// reporting; it avoids shipping curl into the runtime image.
+func healthcheck() error {
+	addr := getenv("LISTEN_ADDR", "127.0.0.1:8088")
+	if host, port, err := net.SplitHostPort(addr); err == nil && (host == "" || host == "0.0.0.0" || host == "::") {
+		addr = net.JoinHostPort("127.0.0.1", port)
+	}
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, err := client.Get("http://" + addr + "/healthz")
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	_, _ = io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("healthz returned %d", resp.StatusCode)
+	}
+	return nil
+}
 func run() error {
 	if err := api.ValidateAuthConfig(); err != nil {
 		return err
@@ -100,6 +129,7 @@ func run() error {
 		return fmt.Errorf("creation intent recovery: %w", err)
 	}
 	go panel.RunQuotaMonitor(ctx)
+	go panel.RunSessionCleanup(ctx)
 	return serve(ctx, srv)
 }
 

cmd/server/main_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -86,3 +87,31 @@ func TestServeWaitsForActiveHandler(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestHealthcheckProbesLocalEndpoint(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/healthz" {
+			http.NotFound(w, r)
+			return
+		}
+		w.Write([]byte("ok"))
+	}))
+	defer srv.Close()
+	_, port, err := net.SplitHostPort(srv.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("LISTEN_ADDR", "127.0.0.1:"+port)
+	if err := healthcheck(); err != nil {
+		t.Fatalf("healthy server rejected: %v", err)
+	}
+	// The container listens on 0.0.0.0; the probe must target loopback.
+	t.Setenv("LISTEN_ADDR", "0.0.0.0:"+port)
+	if err := healthcheck(); err != nil {
+		t.Fatalf("wildcard address rejected: %v", err)
+	}
+	t.Setenv("LISTEN_ADDR", "127.0.0.1:1")
+	if err := healthcheck(); err == nil {
+		t.Fatal("dead endpoint accepted")
+	}
+}