Add template build system with admin panel, async workers, and FlattenRootfs RPC

Introduces an end-to-end template building pipeline: admins submit a recipe
(list of shell commands) via the dashboard, a Redis-backed worker pool spins
up a sandbox, executes each command, and produces either a full snapshot
(with healthcheck) or an image-only template (rootfs flattened via a new
FlattenRootfs host-agent RPC). Build progress and per-step logs are persisted
to a new template_builds table and polled by the frontend.

Backend:
- New FlattenRootfs RPC (proto + host agent + sandbox manager)
- BuildService with Redis queue (BLPOP) and configurable worker pool (default 2)
- Admin-only REST endpoints: POST/GET /v1/admin/builds, GET /v1/admin/builds/{id}
- Migration for template_builds table with JSONB logs and recipe columns
- sqlc queries for build CRUD and progress updates

Frontend:
- /admin/templates page with Templates + Builds tabs
- Create Template dialog with recipe textarea, healthcheck, specs
- Build history with expandable per-step logs, status badges, progress bars
- Auto-polling every 3s for active builds
- AdminSidebar updated with Templates nav item

proto/hostagent/hostagent.proto

@@ -61,6 +61,12 @@ service HostAgentService {
   // Called by the control plane before pause/destroy to persist metrics to DB.
   rpc FlushSandboxMetrics(FlushSandboxMetricsRequest) returns (FlushSandboxMetricsResponse);
 
+  // FlattenRootfs stops the sandbox VM, flattens the device-mapper CoW
+  // snapshot into a standalone rootfs.ext4 in the images directory, then
+  // cleans up all sandbox resources. Used by the template build system to
+  // produce image-only templates (no memory/CPU state).
+  rpc FlattenRootfs(FlattenRootfsRequest) returns (FlattenRootfsResponse);
+
 }
 
 message CreateSandboxRequest {
@@ -284,3 +290,14 @@ message FlushSandboxMetricsResponse {
   repeated MetricPoint points_2h   = 2;
   repeated MetricPoint points_24h  = 3;
 }
+
+// ── FlattenRootfs ────────────────────────────────────────────────────
+
+message FlattenRootfsRequest {
+  string sandbox_id = 1;
+  string name = 2; // template name — output written to images/{name}/rootfs.ext4
+}
+
+message FlattenRootfsResponse {
+  int64 size_bytes = 1;
+}