Fix audit findings: lock architecture, security, deployment hardening

Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):

- Locking: replace the global API and workspace mutexes with per-instance
  and per-user keyed locks (new internal/api/locks.go) so a slow restore,
  upgrade or transfer no longer blocks unrelated users or instances; move
  Docker I/O out of the build queue and invalidate concurrent image-index
  observations with a generation counter; serialize instance deletion
  behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
  purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
  in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
  vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
  HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
  removal guidance after first start, exclude test scripts from the image,
  and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
  polling errors without sticking, disable close during in-flight create.

Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.

internal/api/runtime_test.go

@@ -67,6 +67,45 @@ func TestRuntimeProxyRejectsErrorState(t *testing.T) {
 	}
 }
 
+// createRuntime holds the instance lock during creation; a concurrent DELETE
+// must wait instead of removing the row while the container is still starting.
+func TestInstanceDeleteWaitsForInFlightCreate(t *testing.T) {
+	a, sid := runtimeTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete && strings.Contains(r.URL.Path, "/networks/") {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		t.Errorf("unexpected Docker call %s %s", r.Method, r.URL.Path)
+	})
+	if err := a.s.AddInstance(store.Instance{ID: "creating", UID: "owner", Status: "creating", Created: time.Now()}); err != nil {
+		t.Fatal(err)
+	}
+	inst := a.instanceLocks.Acquire("creating")
+	done := make(chan *httptest.ResponseRecorder, 1)
+	go func() {
+		w := httptest.NewRecorder()
+		a.instance(w, runtimeRequest(http.MethodDelete, "/api/instances/creating", "", sid))
+		done <- w
+	}()
+	select {
+	case w := <-done:
+		t.Fatalf("delete interleaved with creation: %d %s", w.Code, w.Body.String())
+	case <-time.After(300 * time.Millisecond):
+	}
+	inst.Release()
+	select {
+	case w := <-done:
+		if w.Code != 200 {
+			t.Fatalf("status %d: %s", w.Code, w.Body.String())
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("delete stalled after creation finished")
+	}
+	if _, err := a.s.GetInstance("creating"); err == nil {
+		t.Fatal("instance row retained")
+	}
+}
+
 func TestRuntimeCreateLimitAndPolicy(t *testing.T) {
 	if os.Geteuid() != 0 {
 		t.Skip("chown requires root")