Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/auth_tokens.go

@@ -157,9 +157,23 @@ func (a *API) refresh(w http.ResponseWriter, r *http.Request) {
 		fail(w, 401, "authentication required")
 		return
 	}
-	u, csrf, err := a.s.SessionUser(sid.Value)
+	var uid, csrf string
+	err = a.s.DB.QueryRow("SELECT uid,csrf FROM sessions WHERE id=? AND expires>?", sid.Value, time.Now().Unix()).Scan(&uid, &csrf)
 	if err != nil {
-		fail(w, 401, "authentication required")
+		if errors.Is(err, sql.ErrNoRows) {
+			fail(w, 401, "authentication required")
+		} else {
+			fail(w, 500, "session error")
+		}
+		return
+	}
+	u, err := a.s.UserByID(uid)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			fail(w, 401, "authentication required")
+		} else {
+			fail(w, 500, "session error")
+		}
 		return
 	}
 	old, err := r.Cookie("dsh_refresh")
@@ -178,8 +192,20 @@ func (a *API) refresh(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	n, err := result.RowsAffected()
-	if err != nil || n != 1 {
-		fail(w, 401, "authentication required")
+	if err != nil {
+		fail(w, 500, "session error")
+		return
+	}
+	if n != 1 {
+		var active bool
+		err = a.s.DB.QueryRow("SELECT EXISTS(SELECT 1 FROM sessions JOIN auth_refresh ON auth_refresh.sid=sessions.id WHERE sessions.id=? AND sessions.expires>?)", sid.Value, time.Now().Unix()).Scan(&active)
+		if err != nil {
+			fail(w, 500, "session error")
+		} else if active {
+			fail(w, 409, "refresh_conflict")
+		} else {
+			fail(w, 401, "authentication required")
+		}
 		return
 	}
 	a.authCookies(w, r, sid.Value, u.ID, csrf, token)