fix: guide link IDOR, full team-api IDOR hardening, loading overlay

- guide link now server-side replaced to /team/<idx>/guide (no /team/0 403)
- _check_team_host() applied to ALL team endpoints (login, info, targets,
  status, guide, portal, ssh-ws): host must match team domain; panel/gemastik
  host only with admin session. Cross-domain session reuse -> 403.
- host check BEFORE auth on info/targets (no team-existence oracle)
- loading overlay (spinner + text) on start/stop all-team/set; JS util
  showLoading/hideLoading

panel/static/team.html

@@ -83,7 +83,7 @@
       <input type="password" id="loginPass" placeholder="password SSH tim" autocomplete="off">
       <button onclick="doLogin()" style="width:100%;margin-top:16px">Masuk Portal</button>
       <div class="login-err" id="loginErr"></div>
-      <div class="login-note">Belum punya password? Hubungi panitia.<br>Tutorial SSH: <a href="/team/0/guide" id="guideLink">baca panduan</a></div>
+      <div class="login-note">Belum punya password? Hubungi panitia.<br>Tutorial SSH: <a href="/team/0/guide" data-guide-link>baca panduan</a></div>
     </div>
   </div>
 
@@ -193,6 +193,9 @@
 const TEAM_ID = parseInt(document.querySelector('meta[name="team-id"]').content || '0', 10);
 let term = null, ws = null;
 
+// fix all guide links immediately (no auth needed) — /team/0 would 403
+document.querySelectorAll('[data-guide-link]').forEach(a => a.href = `/team/${TEAM_ID}/guide`);
+
 async function api(url, opts) { const r = await fetch(url, opts); return r.json(); }
 function esc(s) { return String(s ?? '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c])); }
 function showView(v) {