Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/images_delete.go

@@ -26,9 +26,11 @@ func (a *API) deleteImage(w http.ResponseWriter, r *http.Request) {
 		fail(w, 400, "invalid image_id")
 		return
 	}
-	// Upgrades also acquire a.mu before buildQueue. Keep both through deletion.
-	a.mu.Lock()
-	defer a.mu.Unlock()
+	// Hold the build queue through the checks and the Docker deletion so a
+	// record cannot flip to missing mid-flight. Upgrades write their journal
+	// entry before creating containers; the transaction below re-checks that
+	// journal, and an upgrade racing an administrator deletion fails safely
+	// with its own rollback path.
 	buildQueue.Lock()
 	defer buildQueue.Unlock()
 	if buildQueue.active[a.s.DB] {
@@ -43,7 +45,7 @@ func (a *API) deleteImage(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer tx.Rollback()
-	// Take SQLite's writer lock before checking intents: reservation does not use a.mu.
+	// Take SQLite's writer lock before checking intents: reservation does not use the build queue.
 	if _, err = tx.ExecContext(ctx, "UPDATE images SET status=status WHERE image_id=?", id); err != nil {
 		fail(w, 500, "image index unavailable")
 		return
@@ -132,6 +134,9 @@ func (a *API) deleteImage(w http.ResponseWriter, r *http.Request) {
 		fail(w, status, "docker image deletion failed")
 		return
 	}
+	// Docker deletion is already authoritative, even if the DB commit fails.
+	// Any inventory observation taken before it must be discarded.
+	a.imageDeleteGeneration++
 	if err = tx.Commit(); err != nil {
 		fail(w, 500, "image deleted but recording failed")
 		return