Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/images_enqueue_concurrency_test.go

@@ -20,7 +20,7 @@ func TestEnqueueBuildConcurrentMissingImageReturnsReplacement(t *testing.T) {
 		switch r.URL.Path {
 		case "/v1.47/images/json":
 			writeJSON(w, []map[string]any{{"Id": "old-image", "Labels": map[string]string{
-				"dsh-mgr.role": "runtime", "dsh-mgr.version": "1.2.3", "dsh-mgr.recipe": imageRecipeRev,
+				"dsh-mgr.role": "runtime", "dsh-mgr.version": "0.2.0-rc.1", "dsh-mgr.recipe": imageRecipeRev,
 			}}})
 		case "/v1.47/images/old-image/json":
 			release := make(chan struct{})
@@ -40,7 +40,7 @@ func TestEnqueueBuildConcurrentMissingImageReturnsReplacement(t *testing.T) {
 			w.WriteHeader(http.StatusInternalServerError)
 		}
 	})
-	seedVerifiedImage(t, a, "old-image", "1.2.3")
+	seedVerifiedImage(t, a, "old-image", "0.2.0-rc.1")
 	var oldID string
 	if err := a.s.DB.QueryRow("SELECT id FROM image_builds WHERE image_id='old-image'").Scan(&oldID); err != nil {
 		t.Fatal(err)
@@ -69,7 +69,7 @@ func TestEnqueueBuildConcurrentMissingImageReturnsReplacement(t *testing.T) {
 		submissions.Add(1)
 		go func() {
 			defer submissions.Done()
-			b, err := a.enqueueBuild(ctx, "u", "1.2.3")
+			b, err := a.enqueueBuild(ctx, "u", "0.2.0-rc.1")
 			done <- result{b, err}
 		}()
 		return done