feat(userbot): prereqs at startup, SPA path guard, provision lock

- ensure_prerequisites runs on startup, not per-request; kube config
  errors surface as 503 PanelError
- serialize provisioning with a lock; drop per-endpoint prereq checks
- guard SPA fallback against path traversal (relative_to)
- add backend tests for auth flow, k8s service, spa routing; ci comment
  for legacy userbot deployments

.gitea/workflows/ci.yaml

@@ -353,6 +353,7 @@ jobs:
           kubectl get secret userbot-common-secrets -n default -o json \
             | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
             | kubectl apply -f -
+          # Keep legacy deployments (forust/anna) in sync with manifests; they have no replicas field, so apply leaves scaling to the user manager only.
           kubectl apply -f userbot/k8s/base/userbots.yaml
           kubectl rollout restart deployment/userbot-panel -n userbot
           kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s