Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

compose.yaml

@@ -20,7 +20,9 @@ services:
       WEB_DIR: /app/web/dist
       UPLOAD_ALLOWED_EXTENSIONS: ${UPLOAD_ALLOWED_EXTENSIONS:-}
       ADMIN_USERNAME: ${DSH_ADMIN_USERNAME:-admin}
-      ADMIN_PASSWORD: ${DSH_ADMIN_PASSWORD:?Set a strong initial admin password}
+      # Read only on first startup while the user table is empty; remove the
+      # value from .env afterwards so the plaintext password is not retained.
+      ADMIN_PASSWORD: ${DSH_ADMIN_PASSWORD:-}
       DOCKER_HOST: unix:///var/run/docker.sock
       DSH_DOCKER_ROOT_VISIBLE: ${DSH_DOCKER_ROOT_DIR:?Set the exact DockerRootDir reported by docker info}
       PANEL_CONTAINER_ID: dsh-mgr-panel
@@ -32,6 +34,14 @@ services:
     tmpfs:
       - /tmp:size=256m
     mem_limit: 1g
+    cpus: 2
+    pids_limit: 512
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/dsh-mgr", "-healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
     logging:
       driver: json-file
       options: