Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/locks.go

@@ -0,0 +1,56 @@
+package api
+
+import "sync"
+
+// keyedLocks hands out one mutex per string key so slow work for one instance
+// or user never blocks unrelated work behind a shared global lock. Registry
+// entries are removed once the last holder releases, keeping the map bounded.
+type keyedLocks struct {
+	mu    sync.Mutex
+	locks map[string]*keyedLock
+}
+
+type keyedLock struct {
+	owner *keyedLocks
+	key   string
+	mu    sync.Mutex
+	refs  int
+}
+
+// Acquire registers interest in the key's lock (blocking callers keep the
+// registry entry alive) and then blocks until the mutex is held.
+func (k *keyedLocks) Acquire(key string) *keyedLock {
+	k.mu.Lock()
+	if k.locks == nil {
+		k.locks = make(map[string]*keyedLock)
+	}
+	l, ok := k.locks[key]
+	if !ok {
+		l = &keyedLock{owner: k, key: key}
+		k.locks[key] = l
+	}
+	l.refs++
+	k.mu.Unlock()
+	l.mu.Lock()
+	return l
+}
+
+// Release frees the mutex and drops the registry entry when no holder or
+// waiter remains.
+func (l *keyedLock) Release() {
+	l.mu.Unlock()
+	k := l.owner
+	k.mu.Lock()
+	l.refs--
+	if l.refs == 0 {
+		delete(k.locks, l.key)
+	}
+	k.mu.Unlock()
+}
+
+// held reports whether any keyed lock is currently held or being waited for.
+func (k *keyedLocks) held() bool {
+	k.mu.Lock()
+	defer k.mu.Unlock()
+	return len(k.locks) > 0
+}