fix: get all imported challenges building and running

Root causes found by prebuilding every challenge image in parallel:
- fjb: ghcr.io base is not anonymously pullable here -> official httpd:2.4.
  pnpm 12 (via corepack on node:20) fails the install with
  ERR_PNPM_IGNORED_BUILDS unless build scripts are approved; neither
  onlyBuiltDependencies in pnpm-workspace.yaml nor --no-ignore-scripts
  suppresses it. The working sequence is:
    pnpm install --ignore-scripts && pnpm approve-builds --all && pnpm rebuild
- xl + kode-viewer: node:20-slim-bookworm is not a real tag -> node:20-bookworm-slim.
- burvesigner: python-dev no longer exists in bookworm -> dropped (python3-dev
  was already there and the source has no py2 syntax).
- burvesigner/hirnfick/s3: apt update and install were separate RUN layers;
  with the bundled apt-insecure.conf the second invocation re-resolved against
  the EOL bullseye-security mirror and 404'd every package. Merged into one
  'update && install' layer (fix_apt_layers.py, idempotent).
- consolidate_images.sh: teams used to build a private image per team
  (team1-x ... team4-x) because no shared image existed. Since the password is
  applied at runtime via chpasswd, one shared services-<name> build is enough;
  this reclaims ~1.5 GB, which matters on a 79 GB disk.
- reconcile_team_state(): a challenge enabled while a team was down left
  state.json without ports/flag/password, so the next compose render died with
  KeyError. Now both the API and the CLI tools reconcile first.

panel/main.py

@@ -390,6 +390,13 @@ async def api_challenge_toggle(challenge: str, req: Request):
     if not found:
         raise HTTPException(404, "Unknown challenge")
     changed = orch.set_challenge_enabled(challenge, enabled)
+    # The registry is the source of truth, but a team's state.json must also
+    # carry ports/password/flag for the new challenge before the compose can be
+    # rendered. reconcile_team_state() fills in anything missing.
+    try:
+        orch.reconcile_team_state()
+    except Exception as e:
+        raise HTTPException(500, f"Rekonsiliasi state tim gagal: {e}")
     # apply to live teams (build/up or stop/remove + receiver restart);
     # skip rebuild when the flag didn't actually change
     if "unchanged" in changed: