Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/password.go

@@ -37,26 +37,7 @@ func (a *API) changePassword(w http.ResponseWriter, r *http.Request) {
 		fail(w, 401, "authentication required")
 		return
 	}
-	locked, err := a.accountLocked(u.Username)
-	if err != nil {
-		fail(w, 503, "authentication unavailable")
-		return
-	}
-	if locked {
-		fail(w, 429, "account temporarily locked; retry later")
-		return
-	}
-	currentHash, err := a.s.Password(u.Username)
-	if err != nil {
-		fail(w, 503, "authentication unavailable")
-		return
-	}
-	if len(in.CurrentPassword) > 72 || bcrypt.CompareHashAndPassword([]byte(currentHash), []byte(in.CurrentPassword)) != nil {
-		if err = a.failedLogin(u.Username); err != nil {
-			fail(w, 503, "authentication unavailable")
-			return
-		}
-		fail(w, 400, "invalid current password")
+	if !a.reauthenticateLocked(w, u.ID, in.CurrentPassword, http.StatusBadRequest) {
 		return
 	}
 	hash, err := bcrypt.GenerateFromPassword([]byte(in.Password), bcrypt.DefaultCost)