Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/api.go

@@ -19,8 +19,10 @@ type API struct {
 	origin           string
 	root             string
 	docker           *docker.Client
-	mu               sync.Mutex
+	readersMu        sync.Mutex
 	workspaceReaders map[string]int
+	instanceLocks    keyedLocks
+	userLocks        keyedLocks
 	loginMu          sync.Mutex
 	loginSources     map[string]loginSource
 	trustedProxies   []*net.IPNet
@@ -29,6 +31,9 @@ type API struct {
 	authKey          []byte
 	authErr          error
 	authLoginMu      sync.Mutex
+
+	// Protected by buildQueue; invalidates image observations across deletions.
+	imageDeleteGeneration uint64
 }
 
 func New(s *store.Store, root string) *API {
@@ -134,6 +139,11 @@ func (a *API) user(r *http.Request) (store.User, string, error) {
 	}
 	return u, csrf, nil
 }
+
+// dummyPasswordHash keeps login latency uniform for unknown usernames so the
+// response timing cannot reveal whether an account exists.
+var dummyPasswordHash, _ = bcrypt.GenerateFromPassword([]byte("timing-equalization"), bcrypt.DefaultCost)
+
 func (a *API) login(w http.ResponseWriter, r *http.Request) {
 	if r.Method != "POST" {
 		fail(w, 405, "method not allowed")
@@ -180,6 +190,7 @@ func (a *API) login(w http.ResponseWriter, r *http.Request) {
 	}
 	h, e := a.s.Password(in.Username)
 	if e != nil {
+		_ = bcrypt.CompareHashAndPassword(dummyPasswordHash, []byte(in.Password))
 		fail(w, 401, "invalid credentials")
 		return
 	}