fix(portal): per-challenge SSH user in web terminal + credential API

The web SSH terminal and the credential API reported `ctfuser` for all 16
challenges, but only the 6 native GEMASTIK XVIII images provision ctfuser.
Every imported XVI/XVII image does `RUN echo root:${PASSWORD} | chpasswd`,
so 10 of 16 participant logins were refused with "Permission denied".

Root causes (all the same class of bug - login hardcoded in the wrong layer):
- main.py websocket ssh handler read st["ssh_user"], a single team-wide value
  defaulting to ctfuser, instead of the per-challenge registry field
- /api/credential proxied the global receiver on :18080, which only knows the
  6 native challenges, so the other 10 returned "Invalid challenge"
- team.html hardcoded the challenge picker to those same 6 challenges, making
  the other 10 unreachable from the terminal entirely
- index.html rendered `<b>ctfuser</b>` and a stale hardcoded SSH port table

Fixes:
- orch.challenge_credential()/all_teams() read the TEAM's state.json, which
  holds the same per-challenge password the panel chpasswds
- gen_receiver_services.py injects SSH_USER_<port> from the registry so the
  receiver's /credential endpoint agrees with the panel
- receiver Challenge.credentials() honours SSH_USER_<port> (ctfuser fallback)
- new /api/team/{idx}/own-challenges feeds the picker; targets now carry
  challenge + ssh_user
- UI takes user and port from the server instead of hardcoding them

Verified: 32/32 credential payloads correct across teams 1-2, and 32/32 real
paramiko SSH logins succeed with whoami confirming the expected account.

Also adds bulk team delete: POST /api/teams/bulk-delete runs one background
thread and is polled via GET /api/teams/bulk-delete/{job_id}, plus per-team
checkboxes with select-all/clear in the UI. Deletion must stay sequential
because delete_team() regenerates shared artifacts at the end.

receiver/challenges/Challenge.py

@@ -1,4 +1,5 @@
 import logging
+import os
 import random
 import string
 
@@ -30,7 +31,13 @@ class Challenge(object):
         pwd = os.environ.get(f'PASSWORD_{self.port}')
         if not pwd:
             pwd = getattr(self.settings, f'PASSWORD_{self.port}', '')
+        # SSH login user is PER-CHALLENGE, not per-package: the imported XVI/XVII
+        # Dockerfiles do `echo root:${PASSWORD} | chpasswd`, so a hardcoded
+        # ctfuser here handed participants a login that could never work.
+        # gen_receiver_services.py injects SSH_USER_<port> from the registry,
+        # which is the single source of truth; the literal is only a fallback.
+        user = os.environ.get(f'SSH_USER_{self.port}', 'ctfuser')
         return {
-            'username': 'ctfuser',
+            'username': user,
             'password': pwd,
         }

receiver/challenges/xvii/Challenge.py

@@ -42,7 +42,13 @@ class Challenge(object):
         pwd = os.environ.get(f'PASSWORD_{self.port}')
         if not pwd:
             pwd = getattr(self.settings, f'PASSWORD_{self.port}', '')
+        # SSH login user is PER-CHALLENGE, not per-package: the imported XVII
+        # Dockerfiles also do `echo root:${PASSWORD} | chpasswd`, so reporting
+        # ctfuser here handed participants a login that could never work.
+        # gen_receiver_services.py injects SSH_USER_<port> from the registry,
+        # which is the single source of truth; the literal is only a fallback.
+        user = os.environ.get(f'SSH_USER_{self.port}', 'ctfuser')
         return {
-            'username': 'ctfuser',
+            'username': user,
             'password': pwd,
         }