fix: address final review findings for master/agent phase 1 (#6)

- inventory: resolve the image reference via ContainerInspect when a moved
  tag makes ContainerList report the image ID
- store: allow reusing a revoked agent's name (partial unique index) and
  mark the revoked agent's compose/container services removed
- web: publish a services event on revoke; no-store on the one-time token page
- webauth: reject empty OIDC state; accept the CSRF form token from the body only
- agent conn: bound the WebSocket handshake to 30s
- hub: log agent_replaced when a connection replaces an older one

internal/agent/conn/conn.go

@@ -22,6 +22,10 @@ import (
 // is too small for the master's future job messages; matches the master.
 const readLimit = 1 << 20
 
+// dialTimeout bounds the TLS + WebSocket handshake so a master that accepts
+// TCP but never answers does not hang the agent forever.
+const dialTimeout = 30 * time.Second
+
 // Source supplies what the agent reports. *inventory.Collector satisfies it.
 type Source interface {
 	Hello(ctx context.Context) (protocol.Hello, error)
@@ -92,10 +96,14 @@ func (a *Agent) Run(ctx context.Context) error {
 // hello was delivered, so Run resets its backoff only after real progress.
 func (a *Agent) session(parent context.Context) (connected bool, err error) {
 	httpClient := &http.Client{Transport: &http.Transport{TLSClientConfig: pin.ClientConfig(a.cfg.Fingerprint)}}
-	c, _, err := websocket.Dial(parent, a.cfg.URL, &websocket.DialOptions{
+	// The dial context only bounds the handshake; coder/websocket does not
+	// tie the established connection to it, so cancelling afterwards is safe.
+	dialCtx, cancelDial := context.WithTimeout(parent, dialTimeout)
+	c, _, err := websocket.Dial(dialCtx, a.cfg.URL, &websocket.DialOptions{
 		HTTPClient: httpClient,
 		HTTPHeader: http.Header{"Authorization": []string{"Bearer " + a.cfg.Token}},
 	})
+	cancelDial()
 	if err != nil {
 		return false, fmt.Errorf("dial master: %w", err)
 	}