fix(ssh): per-challenge SSH login + phew buffering/leak/timeout

Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.

verify_final.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Final end-to-end health + registry toggle verification for the unified
+# attack-defense platform (no secrets echoed; cookie jar in /tmp).
+set -u
+PASS_CAPTURE=/tmp/captured.env
+USER=$(grep -oP '^PANEL_ADMIN_USER=\K.*' /opt/gemastik18-final/panel/.env)
+PW=$(grep -oP '^PANEL_ADMIN_PASS=\K.*' /opt/gemastik18-final/panel/.env)
+LOGIN=$(curl -sS -c /tmp/ejc -X POST -H 'Content-Type: application/json' \
+  -d "{\"user\":\"$USER\",\"pass\":\"$PW\"}" \
+  https://panel.attackdefense.imrnes.team/api/login -w '\n%{http_code}')
+echo "login: $LOGIN"
+CH=$(curl -sS -b /tmp/ejc https://panel.attackdefense.imrnes.team/api/challenges)
+python3 - "$CH" <<'EOF'
+import sys, json
+d = json.loads(sys.argv[1])
+cs = d.get('challenges', [])
+print('challenges:', len(cs))
+print('sets:', sorted({c.get('set') for c in cs}))
+print('enabled count:', sum(1 for c in cs if c.get('enabled')))
+EOF