Add template build system with admin panel, async workers, and FlattenRootfs RPC

Introduces an end-to-end template building pipeline: admins submit a recipe
(list of shell commands) via the dashboard, a Redis-backed worker pool spins
up a sandbox, executes each command, and produces either a full snapshot
(with healthcheck) or an image-only template (rootfs flattened via a new
FlattenRootfs host-agent RPC). Build progress and per-step logs are persisted
to a new template_builds table and polled by the frontend.

Backend:
- New FlattenRootfs RPC (proto + host agent + sandbox manager)
- BuildService with Redis queue (BLPOP) and configurable worker pool (default 2)
- Admin-only REST endpoints: POST/GET /v1/admin/builds, GET /v1/admin/builds/{id}
- Migration for template_builds table with JSONB logs and recipe columns
- sqlc queries for build CRUD and progress updates

Frontend:
- /admin/templates page with Templates + Builds tabs
- Create Template dialog with recipe textarea, healthcheck, specs
- Build history with expandable per-step logs, status badges, progress bars
- Auto-polling every 3s for active builds
- AdminSidebar updated with Templates nav item

db/queries/template_builds.sql

@@ -0,0 +1,33 @@
+-- name: InsertTemplateBuild :one
+INSERT INTO template_builds (id, name, base_template, recipe, healthcheck, vcpus, memory_mb, status, total_steps)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8)
+RETURNING *;
+
+-- name: GetTemplateBuild :one
+SELECT * FROM template_builds WHERE id = $1;
+
+-- name: ListTemplateBuilds :many
+SELECT * FROM template_builds ORDER BY created_at DESC;
+
+-- name: UpdateBuildStatus :one
+UPDATE template_builds
+SET status = $2,
+    started_at = CASE WHEN $2 = 'running' AND started_at IS NULL THEN NOW() ELSE started_at END,
+    completed_at = CASE WHEN $2 IN ('success', 'failed') THEN NOW() ELSE completed_at END
+WHERE id = $1
+RETURNING *;
+
+-- name: UpdateBuildProgress :exec
+UPDATE template_builds
+SET current_step = $2, logs = $3
+WHERE id = $1;
+
+-- name: UpdateBuildSandbox :exec
+UPDATE template_builds
+SET sandbox_id = $2, host_id = $3
+WHERE id = $1;
+
+-- name: UpdateBuildError :exec
+UPDATE template_builds
+SET error = $2, status = 'failed', completed_at = NOW()
+WHERE id = $1;