fix(ssh): per-challenge SSH login + phew buffering/leak/timeout

Passwords failed on 10/16 challenges while state.json looked correct:
- only the 6 native GEMASTIK XVIII images provision 'ctfuser'; every imported
  XVI/XVII image does 'echo root:${PASSWORD} | chpasswd' and logs in as root.
  set_ssh_passwords() hardcoded ctfuser, so chpasswd set a password on an
  account nobody uses -> 'Permission denied' everywhere.
  Registry gains a per-challenge 'ssh_user'; chpasswd now targets the real
  login (and ctfuser/ctf when present) and reports failures loudly.
- phew checker: chall.py block-buffers stdout through the docker exec pipe
  (PYTHONUNBUFFERED now set) and leaks chall.py inside the container on
  timeout (26 orphans, container saturated) -> reaps the whole exec process
  group. Startup does a fresh Pailier keygen (~12 s) so crypto reads need
  _CRYPTO_TIMEOUT, not the 5 s prompt default.

Adds panel/verify_ssh_creds.py (proves the state->container binding from
inside via a real login), audit_ssh_users.sh, reset_runtime.sh.

services/art/Dockerfile

@@ -4,7 +4,11 @@ ARG PASSWORD
 
 RUN echo root:${PASSWORD} | chpasswd
 COPY apt-insecure.conf /etc/apt/apt.conf.d/99gemastik-insecure
-RUN apt-get -o Acquire::AllowInsecureRepositories=true update && apt-get install -y openssh-server curl
+RUN apt-get -o Acquire::AllowInsecureRepositories=true update && \
+    apt-get install -y --no-install-recommends \
+      openssh-server curl \
+      build-essential \
+    && rm -rf /var/lib/apt/lists/*
 RUN echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
 RUN echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
 RUN service ssh start

services/art/Gemfile

@@ -1,4 +1,9 @@
-source "http://rubygems.org"
+source "https://rubygems.org"
 
 gem "sinatra"
-gem "slim"
+gem "slim"
+# Sinatra 4.x no longer bundles a web server: rackup (Rack 3) and puma must be
+# present explicitly or the app exits at boot with
+# "install them with: gem install rackup puma".
+gem "rackup"
+gem "puma"