feat(problems): add bounded administrator package imports

Use live maintenance sessions, durable capacity reservations and streamed SHA-bound ZIP uploads. An ordinary capped import worker validates stored/deflated v1/v2 packages, persists immutable unpublished candidates and finite audit events, and recovers or releases capacity after interruption and expiry.

Validate actual PG/HTTP/worker/storage fault paths in an isolated capped VM (2 passed, 0 skipped), reuse unchanged actual migration roundtrip evidence, and pass affected backend/architecture checks plus the prior full engineering checks.

deploy/problem-import-worker.service.example

@@ -0,0 +1,32 @@
+[Unit]
+Description=KF-OnlineJudge bounded problem import service
+After=postgresql.service
+
+[Service]
+Type=exec
+User=kf-oj
+Group=kf-oj
+WorkingDirectory=/opt/kf-onlinejudge/backend
+EnvironmentFile=/etc/kf-onlinejudge/import-worker.env
+Environment=KF_OJ_IMPORT_WORKER_CGROUP=/sys/fs/cgroup/system.slice/kf-problem-import.service
+ExecStart=/opt/kf-onlinejudge/backend/.venv/bin/kf-problem-import-worker
+MemoryMax=128M
+MemorySwapMax=0
+TasksMax=16
+CPUQuota=100%
+LimitFSIZE=64M
+LimitNOFILE=64
+LimitCORE=0
+NoNewPrivileges=yes
+PrivateNetwork=yes
+RestrictAddressFamilies=AF_UNIX
+ProtectSystem=strict
+ProtectHome=yes
+ReadWritePaths=/var/lib/kf-onlinejudge/imports /var/lib/kf-onlinejudge/artifacts
+KillMode=control-group
+TimeoutStopSec=10
+Restart=on-failure
+RestartSec=30
+
+[Install]
+WantedBy=multi-user.target