Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/config.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"git.misaka.ren/m1saka/dsh-web/internal/backup"
 	"git.misaka.ren/m1saka/dsh-web/internal/store"
-	"golang.org/x/crypto/bcrypt"
 	"gopkg.in/yaml.v3"
 	"io"
 	"net/http"
@@ -87,6 +86,26 @@ func (a *API) config(w http.ResponseWriter, r *http.Request, i store.Instance, a
 		return
 	}
 	i = current
+	if r.Method != http.MethodGet {
+		admissionMu.RLock()
+		defer admissionMu.RUnlock()
+		buildQueue.Lock()
+		err := a.ensureBuilds()
+		buildQueue.Unlock()
+		if err != nil {
+			fail(w, 500, "database error")
+			return
+		}
+		var blocked int
+		if err = a.s.DB.QueryRowContext(r.Context(), "SELECT count(*) FROM image_admissions WHERE image_id=? AND state='blocked'", i.ImageID).Scan(&blocked); err != nil {
+			fail(w, 500, "database error")
+			return
+		}
+		if blocked > 0 {
+			fail(w, 409, "image is blocked; configuration mutations and automatic restarts denied")
+			return
+		}
+	}
 	if i.Status == "error" || a.upgradeRecoveryRequired(i) {
 		fail(w, 409, "instance recovery required")
 		return
@@ -345,9 +364,7 @@ func (a *API) config(w http.ResponseWriter, r *http.Request, i store.Instance, a
 				fail(w, 400, "login password required")
 				return
 			}
-			var hash string
-			if a.s.DB.QueryRow("SELECT pass_hash FROM users WHERE id=?", i.UID).Scan(&hash) != nil || bcrypt.CompareHashAndPassword([]byte(hash), []byte(in.Password)) != nil {
-				fail(w, 403, "incorrect login password")
+			if !a.reauthenticate(w, i.UID, in.Password) {
 				return
 			}
 			if wasRunning {