fix(ssh): per-challenge SSH login + phew buffering/leak/timeout

Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.

panel/delete_teams.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Delete the teams named as args, one at a time, via the panel API.
+# Each per-team delete runs `docker compose down` for every challenge, which
+# takes minutes for a 16-challenge team — so never do this in a foreground
+# call that has to finish inside one tool timeout.
+# Usage: delete_teams.sh <idx> [idx...]
+set -uo pipefail
+BASE=http://127.0.0.1:18081
+JAR=/tmp/ejc
+U=$(grep -oP '^PANEL_ADMIN_USER=\K.*' /opt/gemastik18-final/panel/.env)
+P=$(grep -oP '^PANEL_ADMIN_PASS=\K.*' /opt/gemastik18-final/panel/.env)
+curl -sS -c "$JAR" -X POST -H 'Content-Type: application/json' \
+  -d "{\"user\":\"$U\",\"pass\":\"$P\"}" "${BASE}/api/login" >/dev/null
+for i in "$@"; do
+  echo "=== $(date -Is) delete team${i} ==="
+  curl -sS -b "$JAR" -X DELETE -H 'Content-Type: application/json' \
+    -d '{"purge_scores":true}' "${BASE}/api/teams/${i}" -w '\nHTTP %{http_code}\n'
+done
+echo "=== done ==="