fix: guide link IDOR, full team-api IDOR hardening, loading overlay

- guide link now server-side replaced to /team/<idx>/guide (no /team/0 403)
- _check_team_host() applied to ALL team endpoints (login, info, targets,
  status, guide, portal, ssh-ws): host must match team domain; panel/gemastik
  host only with admin session. Cross-domain session reuse -> 403.
- host check BEFORE auth on info/targets (no team-existence oracle)
- loading overlay (spinner + text) on start/stop all-team/set; JS util
  showLoading/hideLoading

panel/static/guide.html

@@ -96,13 +96,13 @@
   <div class="card">
     <h2>📞 Butuh Bantuan?</h2>
     <p>Hubungi panitia untuk: reset password SSH, restart container, atau lapor service down. Portal ini untuk peserta — panel admin terpisah.</p>
-    <p style="margin-top:8px"><a href="/team/0" id="portalLink">← Kembali ke portal tim</a></p>
+    <p style="margin-top:8px"><a href="/team/0" data-portal-link>← Kembali ke portal tim</a></p>
   </div>
 </div>
 
 <script>
 const TEAM_ID = parseInt(document.querySelector('meta[name="team-id"]').content || '0', 10);
-document.getElementById('portalLink').href = `/team/${TEAM_ID}`;
+document.querySelectorAll('[data-portal-link]').forEach(a => a.href = `/team/${TEAM_ID}`);
 </script>
 </body>
 </html>