Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/config_body_test.go

@@ -66,17 +66,14 @@ func TestConfigSlowBodyRevalidatesWithoutLocks(t *testing.T) {
 				case <-time.After(3 * time.Second):
 					t.Fatal("body read did not start")
 				}
-				if !a.mu.TryLock() {
-					t.Fatal("slow body holds API lock")
+				if a.instanceLocks.held() || a.userLocks.held() {
+					t.Fatal("slow body holds API locks")
 				}
 				if change == "lease" {
+					a.readersMu.Lock()
 					a.workspaceReaders[i.ID]++
+					a.readersMu.Unlock()
 				}
-				a.mu.Unlock()
-				if !workspaceMu.TryLock() {
-					t.Fatal("slow body holds workspace lock")
-				}
-				workspaceMu.Unlock()
 				want := 409
 				if change == "deleted" {
 					if _, err := a.s.DB.Exec("DELETE FROM instances WHERE id=?", i.ID); err != nil {
@@ -136,17 +133,17 @@ func TestConfigBodyErrorsReturnWithoutLocks(t *testing.T) {
 				r.Header.Set("Content-Type", "multipart/form-data; boundary=test")
 			}
 			w := &configDeadlineWriter{ResponseRecorder: httptest.NewRecorder()}
-			a.mu.Lock()
-			workspaceMu.Lock()
+			inst := a.instanceLocks.Acquire("")
+			user := a.userLocks.Acquire("")
 			done := make(chan struct{})
 			go func() { defer close(done); a.config(w, r, store.Instance{}, "backups") }()
 			select {
 			case <-done:
-				workspaceMu.Unlock()
-				a.mu.Unlock()
+				user.Release()
+				inst.Release()
 			case <-time.After(3 * time.Second):
-				workspaceMu.Unlock()
-				a.mu.Unlock()
+				user.Release()
+				inst.Release()
 				t.Fatal("body error waited for locks")
 			}
 			if w.Code != tc.want {
@@ -191,14 +188,12 @@ func TestConfigSlowResponseReleasesLocks(t *testing.T) {
 			case <-time.After(3 * time.Second):
 				t.Fatal("response write did not start")
 			}
-			if !a.mu.TryLock() {
-				t.Fatal("slow response holds API lock")
+			if a.instanceLocks.held() {
+				t.Fatal("slow response holds instance lock")
 			}
-			a.mu.Unlock()
-			if !workspaceMu.TryLock() {
-				t.Fatal("slow response holds workspace lock")
+			if a.userLocks.held() {
+				t.Fatal("slow response holds user lock")
 			}
-			workspaceMu.Unlock()
 
 		})
 	}