Close all 14 findings from the codebase audit (1 high, 5 medium, 8 low):
- Locking: replace the global API and workspace mutexes with per-instance
and per-user keyed locks (new internal/api/locks.go) so a slow restore,
upgrade or transfer no longer blocks unrelated users or instances; move
Docker I/O out of the build queue and invalidate concurrent image-index
observations with a generation counter; serialize instance deletion
behind in-flight creation.
- Security: equalize login timing for unknown usernames, periodically
purge expired sessions/refresh tokens/lock rows, URL-encode orphan IDs
in the frontend, upgrade vitest 3.x->5.x to clear 3 npm audit
vulnerabilities (2 critical RCE).
- Deployment: add a -healthcheck mode probing /healthz (used by Dockerfile
HEALTHCHECK and compose), make ADMIN_PASSWORD optional in compose with
removal guidance after first start, exclude test scripts from the image,
and cap panel resources (cpus: 2, pids_limit: 512).
- Reliability: check rows.Err() on admin listing loops, surface intent
polling errors without sticking, disable close during in-flight create.
Verified: go build/vet, full go test -race -count=1 ./..., frontend
tsc build + 32 tests, npm audit 0, compose config, real-container
healthcheck.
