feat: login page says a locked instance is suspended instead of drawing the form

server/internal/services/instances.go

@@ -35,6 +35,21 @@ func GetInstanceBySlug(slug string) (*models.Instance, error) {
 	return &o, nil
 }
 
+// GetInstanceBySlugIncludingLocked is GetInstanceBySlug without the lock
+// filter. Only the host resolver calls it, so it can tell "no such instance"
+// from "instance locked by Vantage HQ" and let the login page say which; it
+// still refuses a locked instance itself.
+func GetInstanceBySlugIncludingLocked(slug string) (*models.Instance, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var o models.Instance
+	err := db.Col("instances").FindOne(ctx, bson.M{"slug": slug}).Decode(&o)
+	if err != nil {
+		return nil, err
+	}
+	return &o, nil
+}
+
 func ListInstanceIDs() ([]string, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()