fix: address final review findings for master/agent phase 1 (#6)

- inventory: resolve the image reference via ContainerInspect when a moved
  tag makes ContainerList report the image ID
- store: allow reusing a revoked agent's name (partial unique index) and
  mark the revoked agent's compose/container services removed
- web: publish a services event on revoke; no-store on the one-time token page
- webauth: reject empty OIDC state; accept the CSRF form token from the body only
- agent conn: bound the WebSocket handshake to 30s
- hub: log agent_replaced when a connection replaces an older one

internal/master/web/server_test.go

@@ -175,6 +175,7 @@ func TestCreateAgent_ShowsSnippetOnceAndStoresHash(t *testing.T) {
 	body, _ := io.ReadAll(resp.Body)
 
 	require.Equal(t, http.StatusOK, resp.StatusCode)
+	assert.Equal(t, "no-store", resp.Header.Get("Cache-Control"), "the one-time token must not be cached")
 	token := regexp.MustCompile(`pua_[A-Za-z0-9_-]{43}`).FindString(string(body))
 	require.NotEmpty(t, token)
 	assert.Equal(t, agenttoken.Hash(token), store.createdHash("node-4"), "only the hash is stored")
@@ -207,7 +208,9 @@ func TestCreateAgent_Validation(t *testing.T) {
 }
 
 func TestRevokeAgent_RevokesAndDisconnects(t *testing.T) {
-	srv, store, hub, _ := newTestServer(t)
+	srv, store, hub, broker := newTestServer(t)
+	ch, cancel := broker.Subscribe()
+	defer cancel()
 	resp, err := noRedirectClient().Post(srv.URL+"/agents/2/revoke", "application/x-www-form-urlencoded", nil)
 	require.NoError(t, err)
 	_ = resp.Body.Close()
@@ -216,6 +219,12 @@ func TestRevokeAgent_RevokesAndDisconnects(t *testing.T) {
 	assert.Equal(t, "/agents", resp.Header.Get("Location"))
 	assert.Equal(t, int64(2), store.revoked())
 	assert.Equal(t, int64(2), hub.lastDisconnected(), "a revoked agent must be cut off immediately")
+	select {
+	case topic := <-ch:
+		assert.Equal(t, events.Services, topic, "the overview must drop the revoked agent's services")
+	default:
+		t.Fatal("revoke published no services event")
+	}
 }
 
 func TestRevokeAgent_BadID(t *testing.T) {