fix(api): host API checks what the web forms check

- An API volume takes the name and size the web form takes. Its name went
  into the volume XML unchecked, so a name could add elements such as a
  backing store pointing at another VM's disk; the name is also escaped
  there now. A size of 0 and metadata preallocation on a non-qcow2 volume
  are refused or dropped, as on the web form.
- An API compute update with an empty or null password keeps the stored
  one, as the web form does; it emptied it and cut the host off.
- The architectures endpoint answers 404 for an unknown compute instead of
  500; an unrouted copy of it is removed.

computes/api/serializers.py

@@ -20,6 +20,10 @@ class ComputeSerializer(serializers.ModelSerializer):
     )
     type = serializers.ChoiceField(choices=conn_types)
 
+    def validate_password(self, value):
+        # as on the web form, an empty password on an edit keeps the stored one
+        return value or (self.instance.password if self.instance else value)
+
     class Meta:
         model = Compute
         fields = ["id", "name", "hostname", "login", "password", "type", "details", "migration_address"]