Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/api.go

@@ -34,6 +34,13 @@ type API struct {
 
 	// Protected by buildQueue; invalidates image observations across deletions.
 	imageDeleteGeneration uint64
+
+	// Per-image admission evaluations cached for the intent poller; guarded
+	// by evalCacheMu and invalidated by imageDeleteGeneration (buildQueue)
+	// plus a short TTL so Docker observations stay fresh.
+	evalCacheMu  sync.Mutex
+	evalCache    map[string]evalCacheEntry
+	evalCacheGen uint64
 }
 
 func New(s *store.Store, root string) *API {
@@ -62,8 +69,11 @@ func (a *API) Handler() http.Handler {
 	m.HandleFunc("/api/instances", a.instances)
 	m.HandleFunc("/api/instances/", a.instance)
 	m.HandleFunc("/api/images", a.images)
+	m.HandleFunc("/api/images/admission", a.imageAdmission)
+	m.HandleFunc("/api/compatibility", a.compatibility)
 	m.HandleFunc("/api/latest", a.latest)
 	m.HandleFunc("/api/builds", a.builds)
+	m.HandleFunc("/api/builds/", a.buildDetail)
 	m.HandleFunc("/api/intents", a.intents)
 	m.HandleFunc("/api/intents/", a.intent)
 	m.HandleFunc("/api/ws/", a.workspace)