Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/images_policy.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -72,49 +73,69 @@ func (a *API) imageMatches(ctx context.Context, id, version string) (bool, error
 	return im.ID == id && im.platform() == imagePlatform && im.Config.Labels["dsh-mgr.role"] == "runtime" && im.Config.Labels["dsh-mgr.version"] == version && im.Config.Labels["dsh-mgr.recipe"] == imageRecipeRev, nil
 }
 
+var errImageIndexChanged = errors.New("image inventory changed during reconciliation")
+
 func (a *API) imageIndex(ctx context.Context) ([]imageRecord, error) {
+	// Retry stale observations without holding the queue across Docker I/O.
+	// Bound retries so sustained deletions cannot keep a request alive forever.
+	for attempt := 0; attempt < 3; attempt++ {
+		result, err := a.imageIndexSnapshot(ctx)
+		if !errors.Is(err, errImageIndexChanged) {
+			return result, err
+		}
+	}
+	return nil, errImageIndexChanged
+}
+
+func (a *API) imageIndexSnapshot(ctx context.Context) ([]imageRecord, error) {
+	// Phase 1: read the managed index under the queue lock (DB only).
 	buildQueue.Lock()
-	defer buildQueue.Unlock()
-	if err := a.ensureBuilds(); err != nil {
-		return nil, err
+	generation := a.imageDeleteGeneration
+	err := a.ensureBuilds()
+	if err == nil {
+		_, err = a.s.DB.ExecContext(ctx, `INSERT OR IGNORE INTO images(image_id,version,recipe_rev,platform,tag,status,built_at)
+		SELECT image_id,version,recipe_rev,platform,'','missing',COALESCE(finished_at,created_at) FROM image_builds WHERE status IN ('success','missing') AND image_id<>'' ORDER BY created_at DESC,id DESC`)
 	}
-	if _, err := a.s.DB.ExecContext(ctx, `INSERT OR IGNORE INTO images(image_id,version,recipe_rev,platform,tag,status,built_at)
-		SELECT image_id,version,recipe_rev,platform,'','missing',COALESCE(finished_at,created_at) FROM image_builds WHERE status IN ('success','missing') AND image_id<>'' ORDER BY created_at DESC,id DESC`); err != nil {
-		return nil, err
-	}
-	rows, err := a.s.DB.QueryContext(ctx, `SELECT image_id,version,COALESCE(recipe_rev,''),COALESCE(platform,''),tag,status,built_at,
+	var rows *sql.Rows
+	if err == nil {
+		rows, err = a.s.DB.QueryContext(ctx, `SELECT image_id,version,COALESCE(recipe_rev,''),COALESCE(platform,''),tag,status,built_at,
 		(SELECT count(*) FROM instances WHERE instances.image_id=images.image_id) FROM images ORDER BY built_at DESC,image_id`)
-	if err != nil {
-		return nil, err
 	}
 	result := []imageRecord{}
-	for rows.Next() {
-		var im imageRecord
-		if err = rows.Scan(&im.ImageID, &im.Version, &im.RecipeRev, &im.Platform, &im.Tag, &im.Status, &im.Created, &im.UsageCount); err != nil {
-			break
+	if err == nil {
+		for rows.Next() {
+			var im imageRecord
+			if err = rows.Scan(&im.ImageID, &im.Version, &im.RecipeRev, &im.Platform, &im.Tag, &im.Status, &im.Created, &im.UsageCount); err != nil {
+				break
+			}
+			im.ID = im.ImageID
+			result = append(result, im)
+		}
+		scanErr := rows.Err()
+		rows.Close()
+		if err == nil {
+			err = scanErr
 		}
-		im.ID = im.ImageID
-		result = append(result, im)
 	}
-	scanErr := rows.Err()
-	rows.Close()
+	buildQueue.Unlock()
 	if err != nil {
 		return nil, err
 	}
-	if scanErr != nil {
-		return nil, scanErr
+	// Phase 2: inspect Docker without the queue lock; per-image state comes
+	// from real daemon observations, and instance creation must not wait here.
+	known := make(map[string]bool, len(result))
+	for _, im := range result {
+		known[im.ImageID] = true
 	}
-	filters, _ := json.Marshal(map[string][]string{"label": {"dsh-mgr.role=runtime"}})
 	var local []struct {
 		ID     string
 		Labels map[string]string
 	}
-	if err := a.docker.Do(ctx, http.MethodGet, "/images/json?filters="+url.QueryEscape(string(filters)), nil, &local); err != nil {
-		return nil, err
-	}
-	known := make(map[string]bool, len(result))
-	for _, im := range result {
-		known[im.ImageID] = true
+	{
+		filters, _ := json.Marshal(map[string][]string{"label": {"dsh-mgr.role=runtime"}})
+		if err := a.docker.Do(ctx, http.MethodGet, "/images/json?filters="+url.QueryEscape(string(filters)), nil, &local); err != nil {
+			return nil, err
+		}
 	}
 	for _, im := range local {
 		if im.ID != "" && !known[im.ID] && im.Labels["dsh-mgr.role"] == "runtime" {
@@ -154,6 +175,12 @@ func (a *API) imageIndex(ctx context.Context) ([]imageRecord, error) {
 			im.Status = "available"
 		}
 	}
+	// Phase 3: write observed state back under the queue lock (DB only).
+	buildQueue.Lock()
+	defer buildQueue.Unlock()
+	if generation != a.imageDeleteGeneration {
+		return nil, errImageIndexChanged
+	}
 	tx, err := a.s.DB.BeginTx(ctx, nil)
 	if err != nil {
 		return nil, err
@@ -179,7 +206,7 @@ func (a *API) StartImageBuilds() error {
 	if err := a.ensureBuilds(); err != nil {
 		return err
 	}
-	a.startBuildWorker()
+	a.startBuildWorkerLocked()
 	return nil
 }