Add template build system with admin panel, async workers, and FlattenRootfs RPC

Introduces an end-to-end template building pipeline: admins submit a recipe
(list of shell commands) via the dashboard, a Redis-backed worker pool spins
up a sandbox, executes each command, and produces either a full snapshot
(with healthcheck) or an image-only template (rootfs flattened via a new
FlattenRootfs host-agent RPC). Build progress and per-step logs are persisted
to a new template_builds table and polled by the frontend.

Backend:
- New FlattenRootfs RPC (proto + host agent + sandbox manager)
- BuildService with Redis queue (BLPOP) and configurable worker pool (default 2)
- Admin-only REST endpoints: POST/GET /v1/admin/builds, GET /v1/admin/builds/{id}
- Migration for template_builds table with JSONB logs and recipe columns
- sqlc queries for build CRUD and progress updates

Frontend:
- /admin/templates page with Templates + Builds tabs
- Create Template dialog with recipe textarea, healthcheck, specs
- Build history with expandable per-step logs, status badges, progress bars
- Auto-polling every 3s for active builds
- AdminSidebar updated with Templates nav item

db/migrations/20260326090649_template_builds.sql

@@ -0,0 +1,25 @@
+-- +goose Up
+
+CREATE TABLE template_builds (
+    id             TEXT PRIMARY KEY,
+    name           TEXT NOT NULL,
+    base_template  TEXT NOT NULL DEFAULT 'minimal',
+    recipe         JSONB NOT NULL DEFAULT '[]',
+    healthcheck    TEXT,
+    vcpus          INTEGER NOT NULL DEFAULT 1,
+    memory_mb      INTEGER NOT NULL DEFAULT 512,
+    status         TEXT NOT NULL DEFAULT 'pending',
+    current_step   INTEGER NOT NULL DEFAULT 0,
+    total_steps    INTEGER NOT NULL DEFAULT 0,
+    logs           JSONB NOT NULL DEFAULT '[]',
+    error          TEXT,
+    sandbox_id     TEXT,
+    host_id        TEXT,
+    created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    started_at     TIMESTAMPTZ,
+    completed_at   TIMESTAMPTZ
+);
+
+-- +goose Down
+
+DROP TABLE template_builds;