Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/config.go

@@ -63,20 +63,23 @@ func (a *API) config(w http.ResponseWriter, r *http.Request, i store.Instance, a
 			}
 		}
 	}
-	a.mu.Lock()
-	locked := true
+	inst := a.instanceLocks.Acquire(i.ID)
+	locked := inst
 	defer func() {
-		if locked {
-			a.mu.Unlock()
+		if locked != nil {
+			locked.Release()
 		}
 	}()
-	if r.Method != http.MethodGet && a.workspaceReaders[i.ID] > 0 {
-		fail(w, 409, "instance files busy; retry later")
-		return
-	}
 	if r.Method != http.MethodGet {
-		workspaceMu.Lock()
-		defer workspaceMu.Unlock()
+		a.readersMu.Lock()
+		readers := a.workspaceReaders[i.ID]
+		a.readersMu.Unlock()
+		if readers > 0 {
+			fail(w, 409, "instance files busy; retry later")
+			return
+		}
+		user := a.userLocks.Acquire(i.UID)
+		defer user.Release()
 	}
 	current, e := a.s.GetInstance(i.ID)
 	if e != nil || current.UID != i.UID {
@@ -266,8 +269,8 @@ func (a *API) config(w http.ResponseWriter, r *http.Request, i store.Instance, a
 					fail(w, 400, "invalid backup")
 					return
 				}
-				a.mu.Unlock()
-				locked = false
+				locked.Release()
+				locked = nil
 				http.ServeContent(w, r, id+".dshbak", st.ModTime(), f)
 				return
 			}