Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/store/store.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/hex"
 	_ "modernc.org/sqlite"
+	"sync"
 	"time"
 )
 
@@ -25,7 +26,11 @@ type Instance struct {
 	ContainerID string    `json:"container_id"`
 	Created     time.Time `json:"created_at"`
 }
-type Store struct{ DB *sql.DB }
+type Store struct {
+	DB        *sql.DB
+	closed    chan struct{}
+	closeOnce sync.Once
+}
 
 func Open(path string) (*Store, error) {
 	db, e := sql.Open("sqlite", path)
@@ -42,10 +47,11 @@ func Open(path string) (*Store, error) {
 		db.Close()
 		return nil, e
 	}
-	return &Store{db}, nil
+	return &Store{DB: db, closed: make(chan struct{})}, nil
 }
-func (s *Store) Close() { s.DB.Close() }
-func ID() string        { b := make([]byte, 16); _, _ = rand.Read(b); return hex.EncodeToString(b) }
+func (s *Store) Close()                { s.closeOnce.Do(func() { close(s.closed); s.DB.Close() }) }
+func (s *Store) Done() <-chan struct{} { return s.closed }
+func ID() string                       { b := make([]byte, 16); _, _ = rand.Read(b); return hex.EncodeToString(b) }
 func (s *Store) UserByName(n string) (User, error) {
 	var u User
 	var a, t int64