fix(ssh): per-challenge SSH login + phew buffering/leak/timeout

Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.

receiver/challenges/xvi/GemasFetcher.py

@@ -35,29 +35,29 @@ class GemasFetcher(Challenge):
             ## register
             username = self.random_string(5)
             password = self.random_string(5)
-            r = sess.post(f"http://localhost:{self.port}/auth/register", data={"username":username,"password": password}, allow_redirects=False)
+            r = sess.post(self.url(f'/auth/register'), data={"username":username,"password": password}, allow_redirects=False)
             assert r.headers.get("location") == "/auth/login", "Register Failed"
 
             ## login
-            r = sess.post(f"http://localhost:{self.port}/auth/login", data={"username":username,"password": password}, allow_redirects=False)
+            r = sess.post(self.url(f'/auth/login'), data={"username":username,"password": password}, allow_redirects=False)
             assert r.headers.get("location") == "/dashboard", "Login Failed"
 
             ## wget
             content = {"provider": "wget","url":MOCK_URL}
             files = {"file": ("visit", b"\x00\x00"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
-            r = sess.post(f"http://localhost:{self.port}/dashboard/fetch_by_file", files=files)
+            r = sess.post(self.url(f'/dashboard/fetch_by_file'), files=files)
             assert MOCK_DATA_WGET in r.text, "wget Failed"
             
             ## curl
             content = {"provider": "curl","url":MOCK_URL}
             files = {"file": ("visit", b"\x00\x01"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
-            r = sess.post(f"http://localhost:{self.port}/dashboard/fetch_by_file", files=files)
+            r = sess.post(self.url(f'/dashboard/fetch_by_file'), files=files)
             assert r.text.split('\n').pop(0) == MOCK_DATA_CURL, "curl Failed"
 
             ## python
             content = {"provider": "python","url":MOCK_URL}
             files = {"file": ("visit", b"\x00\x02"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
-            r = sess.post(f"http://localhost:{self.port}/dashboard/fetch_by_file", files=files)
+            r = sess.post(self.url(f'/dashboard/fetch_by_file'), files=files)
             assert r.text.startswith('"PCFkb2N0eXBlIGh0bWw'), "python Failed"
 
             return True