Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/files_test.go

@@ -446,6 +446,9 @@ func TestWorkspaceSafetyAndUpload(t *testing.T) {
 	defer s.Close()
 	a := &API{s: s, root: t.TempDir()}
 	u := store.User{ID: "user", Quota: 8}
+	if err := s.CreateUser(u, "unused"); err != nil {
+		t.Fatal(err)
+	}
 	root, e := a.openWorkspace(u)
 	if e != nil {
 		t.Fatal(e)