Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

web/src/editorBuild.test.ts

@@ -0,0 +1,30 @@
+import { expect, it, vi } from 'vitest';
+import { build } from 'vite';
+
+it('keeps Monaco lazy, production chunks below 500 kB, and static imports acyclic', async () => {
+  vi.stubEnv('NODE_ENV', 'production');
+  const result = await build({ build: { write: false }, logLevel: 'silent' }).finally(() => vi.unstubAllEnvs());
+  if (!('output' in result)) throw new Error('Expected a single application build');
+  const chunks = result.output.filter(asset => asset.type === 'chunk');
+  const byName = new Map(chunks.map(chunk => [chunk.fileName, chunk]));
+  const visited = new Set<string>();
+  function visit(name: string, ancestors: string[] = []) {
+    expect(ancestors, `Static chunk cycle: ${[...ancestors, name].join(' -> ')}`).not.toContain(name);
+    if (visited.has(name)) return;
+    const chunk = byName.get(name);
+    if (!chunk) return;
+    chunk.imports.forEach(dependency => visit(dependency, [...ancestors, name]));
+    visited.add(name);
+  }
+  for (const chunk of chunks) {
+    expect(Buffer.byteLength(chunk.code), chunk.fileName).toBeLessThanOrEqual(500_000);
+    visit(chunk.fileName);
+  }
+  const entry = chunks.find(chunk => chunk.isEntry)!;
+  visited.clear();
+  visit(entry.fileName);
+  for (const name of visited) {
+    expect(Object.keys(byName.get(name)!.modules).some(id => id.includes('/monaco-editor/'))).toBe(false);
+  }
+  expect(chunks.some(chunk => chunk.isDynamicEntry && chunk.name === 'MonacoProfileEditor')).toBe(true);
+}, 60_000);