A sweep of the whole console: status codes, a data race, atomic writes, dead code

From the race detector, staticcheck, a garbage-in battery over every safe route and a
headless pass through every tab on two machines. Fixed:
- docker inspect/health of a container that isn't there answered 500; now 404, and a
  daemon that is down 503 (dockerErr, with a test).
- /api/virt/instances/{name} on a machine without Incus answered 502 "incus not found";
  it now says Incus isn't ready, like its siblings.
- Deleting a ZFS snapshot with a bad name answered 500; a bad name is 400, a snapshot
  that doesn't exist 404.
- The task list read a task's Running flag without the task's lock while the waiter
  goroutine cleared it: a data race, now read under the lock.
- The Virtualization export config and run record were written in place; a crash
  mid-write would have left a half file. Atomic now, like the config and state files.
- An unused function in kvm.go, one in incus/subnet.go, an unused field in files/move.go
  and a capitalised error string, from staticcheck.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/incus/export.go

@@ -10,6 +10,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"hamlab/internal/store"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -91,7 +92,7 @@ func (m *Manager) SaveExportConfig(c ExportConfig) error {
 	}
 	c.Updated = time.Now()
 	b, _ := json.MarshalIndent(c, "", "  ")
-	return os.WriteFile(m.exportConfigPath(), b, 0o644)
+	return store.WriteFileAtomic(m.exportConfigPath(), b, 0o644)
 }
 
 type ExportRun struct {
@@ -226,6 +227,6 @@ func (m *Manager) RunExports(ctx context.Context, names []string, w func(string)
 	}
 	run.Seconds = time.Since(start).Seconds()
 	b, _ := json.MarshalIndent(run, "", "  ")
-	_ = os.WriteFile(m.exportRunPath(), b, 0o644)
+	_ = store.WriteFileAtomic(m.exportRunPath(), b, 0o644)
 	return run
 }

internal/incus/subnet.go

@@ -14,7 +14,6 @@ import (
 	"net/netip"
 	"os"
 	"os/exec"
-	"strings"
 	"time"
 )
 
@@ -125,6 +124,3 @@ func dockerPools() []string {
 	}
 	return []string{"172.17.0.0/12", "192.168.0.0/16"}
 }
-
-// String form used in the layout file and on the page.
-func prefixString(p netip.Prefix) string { return strings.TrimSpace(p.Masked().String()) }

internal/incus/vga.go

@@ -130,7 +130,7 @@ func (m *Manager) openVGA(ctx context.Context, client *http.Client, name string,
 	resp, err := client.Do(req)
 	if err != nil {
 		if isPermission(err) {
-			return nil, errors.New("Ham Lab's account can't reach Incus's socket; Finish setup on the Virtualization tab puts it in incus-admin")
+			return nil, errors.New("this account can't reach Incus's socket; Finish setup on the Virtualization tab puts Ham Lab in incus-admin")
 		}
 		return nil, err
 	}