[MoussaabBadla]

Second hardening layer — covers the security-critical per-team logic and the CTFd auth flow. Builds on the CI + unit harness from #1.

Tests added (11)

test_ownership.py — drives the real DockerManager over an in-memory instance store (ownership checks are early gates that return before any Docker call, so no daemon needed):

• Team mode: a player on team B cannot stop team A's instance (the core per-team isolation guarantee).
• Team mode: a different user on the same team passes the ownership gate.
• User mode: a user cannot stop another user's instance.
• Unknown instance is rejected.
• Quota counting groups by team (team mode) vs user (user mode), and only RUNNING/STARTING instances count.

test_ctfd_auth.py — CTFdAuth.validate_token with a stubbed httpx client:

• Valid token derives user_id / username / team_id / team_name.
• User without a team.
• Non-200 and success: false are both rejected.

Why this matters

These lock down exactly the behavior the "per-team auth" backlog item was about — proving the instancer already enforces per-team ownership and derives team identity from the player's own CTFd token. 29 tests total now green.