feat(userbot): prereqs at startup, SPA path guard, provision lock

- ensure_prerequisites runs on startup, not per-request; kube config
  errors surface as 503 PanelError
- serialize provisioning with a lock; drop per-endpoint prereq checks
- guard SPA fallback against path traversal (relative_to)
- add backend tests for auth flow, k8s service, spa routing; ci comment
  for legacy userbot deployments

userbot/panel/backend/tests/test_auth_service.py

@@ -82,3 +82,20 @@ async def test_string_session_is_validated_and_closed(monkeypatch) -> None:
 
     assert result.session_string == "exported-session"
     assert FakeClient.instances[-1].disconnected is True
+
+
+@pytest.mark.asyncio
+async def test_start_phone_rejects_overflow(monkeypatch) -> None:
+    from app.errors import PanelError
+
+    monkeypatch.setattr("app.auth_service.Client", FakeClient)
+    auth = TelegramAuthService(ttl_seconds=3600, max_flows=2)
+
+    await auth.start_phone(phone_payload())
+    await auth.start_phone(phone_payload())
+
+    with pytest.raises(PanelError) as error:
+        await auth.start_phone(phone_payload())
+
+    assert error.value.status_code == 429
+    assert "Too many pending" in error.value.detail