Add Azure Container Instances backend + CTFd 3.8 compatibility

[therealcybermattlee]

TL;DR

This PR adds an Azure Container Instances (ACI) backend to the plugin so
operators on Azure can run challenge containers as managed cloud workloads
instead of relying on a single Docker host. It also brings the plugin
forward to CTFd 3.8.x (the existing code targets the older Jinja+jQuery
challenge modal and breaks on the new Alpine.js one), and rolls in several
small fixes that surfaced while shipping a live CTF.

The Docker path is unchanged for existing users — backend selection is a
new setting that defaults to docker.

---

What's in here

1. Azure Container Instances backend (container_manager_aci.py)

• ACIContainerManager mirrors the existing ContainerManager API
  (create_container, is_container_running, kill_container, …).
• Auth via DefaultAzureCredential from inside the CTFd container —
  works with the host VM's system-assigned managed identity, with no
  static secrets.
• ACR image pulls use a user-assigned managed identity (UAMI)
  referenced from the container group, so the CTFd VM identity only
  needs Contributor on the RG and Managed Identity Operator on the
  UAMI; the UAMI gets AcrPull on the ACR. No registry passwords in
  CTFd settings.
• Image dropdown in the admin form pulls the live ACR repository/tag
  list via azure-containerregistry (ContainerRegistryClient).
• Per-container DNS labels are derived from the player's username
  (unicode-aware slugify, 4-char random suffix for collision safety),
  e.g. beyondctf-claude-a3b8.westus2.azurecontainer.io.
• Memory/CPU requests are clamped and rounded to Azure's allowed
  precision (0.1 GB memory, 0.01 cpu) — Azure rejects e.g. 1500/1024.

Backend selection lives in plugin settings (backend = docker|aci),
plus a new Azure-specific settings block (resource group, region, UAMI
resource ID, ACR login server, DNS label prefix).

2. Async provisioning + polling

ACI cold-starts take 20–60s, which blocks the request thread on a
synchronous create. Moved provisioning into a background thread that
writes status (provisioning / running / failed) onto
ContainerInfoModel, and added GET /containers/api/status/<row_id>
for the frontend to poll. The Docker path benefits too — the user
isn't held on a hanging request if their host is slow.

3. CTFd 3.8 compatibility

CTFd 3.8 swapped the challenge modal from Jinja+jQuery to a hard-coded
Alpine.js template that doesn't extend plugin templates. This PR makes
the plugin work on 3.8 without breaking older 3.x:

• view.js no longer dereferences CTFd.lib.markdown at load time
  (it's undefined on 3.8). The renderer is initialized lazily inside
  preRender, with fallbacks for both the legacy callable shape and
  the newer object shape, plus a plain-text-escape fallback if
  neither is present.
• The challenge view UI (Get Connection Info / Reset / Stop / Add
  Time buttons + result panel) is injected from JS in postRender,
  anchored off the stable .challenge-desc element, instead of
  relying on {% block connection_info %} in view.html (the block
  hook no longer fires).
• solve() no longer 500s on state-only PATCH when decay is 0
  (caused ZeroDivisionError in calculate_value).
• Asset URLs include a content-hash query string (?v=<sha256-prefix>)
  so browsers pick up new JS/CSS without manual cache busting.

4. Per-challenge state restore on modal reopen

Closing and reopening a challenge modal used to always show the
Request button, and clicking it would spawn a new container even
when the player already had one running. Added
GET /containers/api/running/<chal_id> which returns the player's
current container state (running / provisioning / none) without
spawning anything, and the view JS uses it to render the right UI on
modal open.

5. Tear down container on solve

When a player submits a correct flag for a container challenge, the
plugin now kills their ACI/Docker container and clears the row in
solve(). Saves on idle compute and stops the now-pointless URL from
sitting open.

6. Smaller fixes

• Admin containers dashboard badge reflects the active backend
  ("Docker Connected" vs "Azure Container Instances Connected").
• route_containers_dashboard no longer references an undefined
  settings name (was a 500).
• README has a Docker-Compose deployment section matching the layout
  most operators end up with (Caddy + MariaDB + Redis + bind-mounted
  plugin).

---

Heads-up: per-user mode

Earlier in this branch, ContainerInfoModel was switched from
team_id to user_id so per-player ACI containers were addressable
in user-mode CTFs (which the project I was running). If you'd prefer
to keep team-mode as the default and add user-mode as a setting, I'm
happy to refactor that — it's an isolated change touching
ContainerInfoModel, the four player routes, and one dashboard column.

---

Testing

End-to-end verified against a live CTFd 3.8.4 deployment on Azure
(CTFd in Docker on an Azure VM, ACI in westus2, ACR with UAMI auth):

• ✅ Provision a whoami SSH challenge → ACI container running with
  per-user DNS hostname.
• ✅ Provision a view-source web challenge (nginx:alpine +
  static HTML) → reachable, flag in source.
• ✅ Reset / Add Time / Stop all behave correctly.
• ✅ State persists across modal close+reopen.
• ✅ Correct flag submission tears down the container.
• ✅ Slug helper validated against 14 username edge cases (accents,
  unicode, all-symbol, oversized, mixed case, leading/trailing
  punctuation).
• ✅ Admin containers dashboard loads with the right backend label.

---

Settings additions (admin → containers → Settings)

Key	Purpose
backend	docker (default) or aci
azure_resource_group	RG name (ACI lands here)
azure_region	e.g. westus2
azure_uami_resource_id	full ARM ID of the UAMI used for ACR pulls
acr_login_server	e.g. <registry>.azurecr.io
azure_dns_label_prefix	base for per-user hostnames

A new requirements.txt adds:

azure-identity
azure-mgmt-containerinstance
azure-containerregistry

These are only imported lazily when backend == "aci", so they're
optional dependencies for Docker-only deployments.

---

Happy to split this into separate PRs (ACI backend / 3.8 compat /
fixes) if you'd prefer that for review.