Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/auth_tokens_test.go

@@ -213,3 +213,52 @@ func TestUnsafeAuthKeyFailsClosed(t *testing.T) {
 		t.Fatal(w.Code)
 	}
 }
+
+func TestSessionCleanupRemovesExpiredRows(t *testing.T) {
+	a, _ := authFixture(t)
+	expired, _, e := a.s.Session("alice")
+	if e != nil {
+		t.Fatal(e)
+	}
+	current, _, e := a.s.Session("alice")
+	if e != nil {
+		t.Fatal(e)
+	}
+	past := time.Now().Add(-time.Minute).Unix()
+	if _, e = a.s.DB.Exec("UPDATE sessions SET expires=? WHERE id=?", past, expired); e != nil {
+		t.Fatal(e)
+	}
+	token, e := refreshToken()
+	if e != nil {
+		t.Fatal(e)
+	}
+	if _, e = a.s.DB.Exec("INSERT INTO auth_refresh(sid,token_hash) VALUES(?,?)", expired, refreshHash(token)); e != nil {
+		t.Fatal(e)
+	}
+	future := time.Now().Add(time.Hour).Unix()
+	if _, e = a.s.DB.Exec("INSERT INTO auth_failures(username,failures,locked_until) VALUES('expired-lock',5,?)", past); e != nil {
+		t.Fatal(e)
+	}
+	if _, e = a.s.DB.Exec("INSERT INTO auth_failures(username,failures,locked_until) VALUES('active-lock',5,?)", future); e != nil {
+		t.Fatal(e)
+	}
+	a.cleanupSessions(time.Now().Unix())
+	var n int
+	for _, q := range []string{
+		"SELECT count(*) FROM sessions WHERE id='" + expired + "'",
+		"SELECT count(*) FROM auth_refresh WHERE sid='" + expired + "'",
+		"SELECT count(*) FROM auth_failures WHERE username='expired-lock'",
+	} {
+		if err := a.s.DB.QueryRow(q).Scan(&n); err != nil || n != 0 {
+			t.Fatalf("expired row retained: %s (%d, %v)", q, n, err)
+		}
+	}
+	for _, q := range []string{
+		"SELECT count(*) FROM sessions WHERE id='" + current + "'",
+		"SELECT count(*) FROM auth_failures WHERE username='active-lock'",
+	} {
+		if err := a.s.DB.QueryRow(q).Scan(&n); err != nil || n != 1 {
+			t.Fatalf("live row removed: %s (%d, %v)", q, n, err)
+		}
+	}
+}