fix: address final review findings for master/agent phase 1 (#6)

- inventory: resolve the image reference via ContainerInspect when a moved
  tag makes ContainerList report the image ID
- store: allow reusing a revoked agent's name (partial unique index) and
  mark the revoked agent's compose/container services removed
- web: publish a services event on revoke; no-store on the one-time token page
- webauth: reject empty OIDC state; accept the CSRF form token from the body only
- agent conn: bound the WebSocket handshake to 30s
- hub: log agent_replaced when a connection replaces an older one

internal/master/store/migrations/0001_init.sql

@@ -6,7 +6,7 @@ CREATE TABLE master_identity (
 
 CREATE TABLE agents (
     id            bigserial PRIMARY KEY,
-    name          text NOT NULL UNIQUE,
+    name          text NOT NULL,
     token_hash    text NOT NULL UNIQUE,
     hostname      text NOT NULL DEFAULT '',
     agent_version text NOT NULL DEFAULT '',
@@ -16,6 +16,9 @@ CREATE TABLE agents (
     created_at    timestamptz NOT NULL DEFAULT now()
 );
 
+-- A revoked agent's name can be reused by a new agent.
+CREATE UNIQUE INDEX agents_name_active ON agents (name) WHERE revoked_at IS NULL;
+
 CREATE TABLE services (
     id               bigserial PRIMARY KEY,
     kind             text NOT NULL CHECK (kind IN ('compose', 'swarm', 'container')),