fix: address final review findings for master/agent phase 1 (#6)

- inventory: resolve the image reference via ContainerInspect when a moved
  tag makes ContainerList report the image ID
- store: allow reusing a revoked agent's name (partial unique index) and
  mark the revoked agent's compose/container services removed
- web: publish a services event on revoke; no-store on the one-time token page
- webauth: reject empty OIDC state; accept the CSRF form token from the body only
- agent conn: bound the WebSocket handshake to 30s
- hub: log agent_replaced when a connection replaces an older one

internal/master/webauth/auth.go

@@ -71,7 +71,7 @@ func (a *Auth) Callback(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	state, verifier, ok := strings.Cut(flow.Value, ".")
-	if !ok || subtle.ConstantTimeCompare([]byte(r.URL.Query().Get("state")), []byte(state)) != 1 {
+	if !ok || state == "" || subtle.ConstantTimeCompare([]byte(r.URL.Query().Get("state")), []byte(state)) != 1 {
 		http.Error(w, "invalid login state", http.StatusBadRequest)
 		return
 	}
@@ -150,7 +150,7 @@ func (a *Auth) Require(next http.Handler) http.Handler {
 		if r.Method != http.MethodGet && r.Method != http.MethodHead {
 			token := r.Header.Get("X-CSRF-Token")
 			if token == "" {
-				token = r.FormValue("csrf_token")
+				token = r.PostFormValue("csrf_token") // body only: a token in the URL leaks via logs and Referer
 			}
 			if subtle.ConstantTimeCompare([]byte(token), []byte(sess.CSRFToken)) != 1 {
 				http.Error(w, "invalid CSRF token", http.StatusForbidden)