Fix concurrency, security, and correctness issues across backend and frontend

- C1: Add sync.RWMutex to vm.Manager to protect concurrent vms map access
- H1: Fix IP arithmetic overflow in network slot addressing (byte truncation)
- H5: Fix MultiplexedChannel.Fork() TOCTOU race (move exited check inside lock)
- H8: Remove snapshot overwrite — return template_name_taken conflict instead
- H9: Wrap DeleteAccount DB ops in a transaction, make team deletion fatal
- H10: Sanitize serviceErrToHTTP to stop leaking internal error messages
- H11: Add deleted_at IS NULL to GetUserByEmail/GetUserByID queries
- H12: Add id DESC to audit log composite index for cursor pagination
- H15: Delete dead AuthModal.svelte component
- H17: Move JWT from WebSocket URL query param to first WS message
- H18: Fix $derived to $derived.by in FilesTab breadcrumbs

frontend/src/app.css

@@ -180,9 +180,11 @@ body {
 	50%       { transform: translateY(-6px); }
 }
 
-/* CSS containment — isolate layout/paint for independent UI regions */
+/* CSS containment — isolate paint for independent UI regions.
+   Note: `contain: layout` is omitted because it creates a containing block
+   that breaks `position: fixed` popups rendered inside <main>. */
 main {
-	contain: layout style;
+	contain: style;
 }
 
 /* Respect user motion preferences — covers both CSS class animations and inline style animations */