feat(userbot): prereqs at startup, SPA path guard, provision lock

- ensure_prerequisites runs on startup, not per-request; kube config
  errors surface as 503 PanelError
- serialize provisioning with a lock; drop per-endpoint prereq checks
- guard SPA fallback against path traversal (relative_to)
- add backend tests for auth flow, k8s service, spa routing; ci comment
  for legacy userbot deployments

userbot/panel/backend/tests/test_kubernetes_service.py

@@ -80,6 +80,27 @@ def test_partial_provision_rolls_back_only_created_resources() -> None:
     kube.apps.delete_namespaced_deployment.assert_not_called()
 
 
+def test_provision_conflict_reports_existing_instance() -> None:
+    kube = service()
+    kube.assert_available = Mock()
+    kube.apps.create_namespaced_deployment.side_effect = ApiException(status=409)
+
+    with pytest.raises(PanelError) as error:
+        kube.provision(account(), "SESSION")
+
+    assert error.value.status_code == 409
+    assert "already exists" in error.value.detail
+    # Partial resources created before the 409 must be rolled back.
+    kube.core.delete_namespaced_secret.assert_called_once_with(
+        "userbot-test-account-credentials",
+        "userbot",
+    )
+    kube.core.delete_namespaced_persistent_volume_claim.assert_called_once_with(
+        "userbot-test-account-data",
+        "userbot",
+    )
+
+
 def test_delete_retains_pvc_unless_explicitly_requested() -> None:
     kube = service()
     deployment = SimpleNamespace(