- get_vm_status and get_container_status were missing require_vm_access(),
allowing any user with vms.view to see any VM status regardless of ownership.
Now users with vms.view.own can only access their own VMs (403 otherwise).
- Downgrade upload-artifact@v4 → @v3: v4 is not supported on Gitea (GHES)
and caused CI failures on every run.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
- AttributeError: OSTemplate has no 'template_vmid' field; the actual column is 'vmid'.
- Use OSTemplate.get_vmid_for_node() to support cross-node replicated templates,
falling back to source_node/vmid otherwise.
- VMInstance.memory is stored in bytes, but Proxmox config expects MB.
