feat(userbot): prereqs at startup, SPA path guard, provision lock

- ensure_prerequisites runs on startup, not per-request; kube config
  errors surface as 503 PanelError
- serialize provisioning with a lock; drop per-endpoint prereq checks
- guard SPA fallback against path traversal (relative_to)
- add backend tests for auth flow, k8s service, spa routing; ci comment
  for legacy userbot deployments

userbot/panel/backend/app/auth_service.py

@@ -39,13 +39,20 @@ class AuthorizedAccount:
 
 
 class TelegramAuthService:
-    def __init__(self, ttl_seconds: int = 600) -> None:
+    def __init__(self, ttl_seconds: int = 600, max_flows: int = 50) -> None:
         self.ttl = timedelta(seconds=ttl_seconds)
+        self.max_flows = max_flows
         self.flows: dict[str, AuthFlow] = {}
         self._lock = asyncio.Lock()
 
     async def start_phone(self, account: PhoneStart) -> str:
         await self._cleanup_expired()
+        async with self._lock:
+            if len(self.flows) >= self.max_flows:
+                raise PanelError(
+                    429,
+                    "Too many pending authorization flows; try again later",
+                )
         flow_id = secrets.token_urlsafe(24)
         telegram = Client(
             f"auth-{flow_id}",