fix: make challenge toggle actually work end-to-end (5 root-cause bugs)

Found by testing a real enable/disable cycle (art, fjb, gift-card):

1. compose_gen always swapped build->image, so a never-built challenge
   produced 'pull access denied for services-<name>'. Now it only reuses
   the image when it exists locally, otherwise keeps build: so
   'docker compose up --build' builds it.
2. Canonical templates use 'build: context: .' (written for the shared
   services/ tree). In the per-team compose that resolves to the team dir
   which has no Dockerfile -> 'failed to read dockerfile'. The renderer
   now rewrites the main service's context to ./<name>.
3. Teams created before the XVI/XVII import had no xvi/xvii subpackages
   under their local challenges/ dir, so the regenerated receiver main.py
   crash-looped on import. gen_receiver_main now mirrors ALL shared
   checkers (native + xvi + xvii) into every team receiver on each sync.
4. systemd Environment= keys can't contain hyphens, so
   CHALLENGE_PORT_GIFT-CARD was silently dropped. Keys are now
   normalized to underscores on both the writer and reader side.
5. Several checkers called 'docker exec' with no timeout; against a
   container with accumulated chall.py zombies that blocks forever and
   stalls the whole SLA loop. Added mandatory timeouts (Phew, Sheesh,
   Carbeat, Poke, Warmup).

Also: enabling a challenge now copies its source tree into each team's
services/ dir (team dirs only held challenges enabled at create_team
time), and the XVII checkers were rewritten to be protocol-aware
(gift-card/gift-voucher are socat TCP, not HTTP) with strict timeouts.

panel/teams.py

@@ -116,6 +116,20 @@ def sync_challenge_runtime(name: str, enabled: bool) -> dict:
                     name) or f"chall{idx}_{name}_{secrets.token_hex(4)}"
                 # write state BEFORE rendering (render needs ports[name])
                 (sf).write_text(json.dumps(st, indent=2))
+                # Copy the challenge source into the team's services tree so a
+                # `build: context: .` resolves (team dirs only hold challenges
+                # that were enabled at create_team time).
+                team_svc_src = svc_dir / name
+                if not team_svc_src.exists():
+                    src = SERVICES_SRC / name
+                    if not src.exists():
+                        raise FileNotFoundError(f"sumber service tidak ada: {src}")
+                    shutil.copytree(src, team_svc_src,
+                                    ignore=shutil.ignore_patterns("__pycache__", "*.pyc", ".git"))
+                # apt-insecure.conf is needed by every challenge build
+                shared_apt = SERVICES_SRC / "apt-insecure.conf"
+                if shared_apt.exists() and not (team_svc_src / "apt-insecure.conf").exists():
+                    shutil.copy2(shared_apt, team_svc_src / "apt-insecure.conf")
                 # regenerate whole compose (so enabled challenge included),
                 # then bring up just this service
                 new_text = compose_gen.render_team_compose(idx, st)