Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/reconcile.go

@@ -44,6 +44,20 @@ func (a *API) Reconcile(ctx context.Context) error {
 	}
 	known := make(map[string]record)
 	for _, r := range records {
+		if r.container == "" && (r.status == "creating" || r.status == "error") {
+			i, loadErr := a.s.GetInstance(r.id)
+			if loadErr != nil {
+				return loadErr
+			}
+			if recoveryErr := a.recoverRuntimeContainer(ctx, &i); recoveryErr != nil {
+				a.s.AddAudit(r.uid, "reconcile.recovery_error", r.id, recoveryErr.Error())
+			}
+			r.container = i.ContainerID
+			r.status = "error"
+			if _, err = a.s.DB.ExecContext(ctx, "UPDATE instances SET status='error' WHERE id=?", r.id); err != nil {
+				return err
+			}
+		}
 		known[r.id] = r
 	}
 	matched := make(map[string]bool)