fix: bulk challenge enable path (compose YAML, base images, async toggle, tooling)

- fix_dup_volumes.py: 4 canonical templates had TWO volumes: keys inside one
  service (invalid YAML -> 'mapping key volumes already defined'), which broke
  every enable for anti-alchemy/burvesigner/gemas-notes/kode-viewer.
- fjb: ghcr.io base is not anonymously pullable on this host; swapped to the
  official httpd:2.4 (its httpd.conf only uses stock modules). Added
  onlyBuiltDependencies to package.json (pnpm >=10 blocks esbuild's postinstall).
- xl + kode-viewer: node:20-slim-bookworm is not a real tag; use
  node:20-bookworm-slim. gift-voucher: buster -> bookworm.
- prebuild_images.py: build each challenge's shared services-<name> image once
  in parallel (passes a placeholder PASSWORD build-arg, since several Dockerfiles
  run chpasswd and fail on an empty arg).
- set_enabled.py / sync_all_challenges.py: batch registry flip + runtime apply
  that survives panel restarts and reports per-team results.
- Challenge toggle is now async: PATCH returns a job id, the client polls
  /api/challenges/jobs/<id> so a multi-minute build no longer blocks the panel.
  Added _SYNC_LOCK to serialize concurrent compose rewrites.

panel/teams.py

@@ -26,6 +26,7 @@ import secrets
 import shutil
 import subprocess
 import sys
+import threading
 import time
 import uuid
 from datetime import datetime
@@ -78,7 +79,23 @@ def set_challenge_enabled(name: str, enabled: bool) -> dict:
     raise KeyError(f"Challenge {name} tidak ada di registry")
 
 
+# Serializes sync_challenge_runtime(): each run rewrites every team's
+# docker-compose.yml and shells out to docker compose in those same dirs.
+_SYNC_LOCK = threading.Lock()
+
+
 def sync_challenge_runtime(name: str, enabled: bool) -> dict:
+    """Apply one challenge's enabled flag to every live team.
+
+    Serialized via _SYNC_LOCK: multiple toggle requests rewrite the same
+    per-team docker-compose.yml and run docker compose in the same
+    directories, so concurrent syncs would corrupt each other's output.
+    """
+    with _SYNC_LOCK:
+        return _sync_challenge_runtime_locked(name, enabled)
+
+
+def _sync_challenge_runtime_locked(name: str, enabled: bool) -> dict:
     """Apply an enable/disable toggle to every RUNNING team:
     - regenerate that team's compose from the registry (compose_gen)
     - for ENABLE: docker compose up -d <name> (builds image first if needed)