Fix snapshot race, delete auth, sparse dd, default disk to 5GB

Snapshot race fix:
- Pre-mark sandbox as "paused" in DB before issuing CreateSnapshot and
  PauseSandbox RPCs, preventing the reconciler from marking it "stopped"
  during the flatten window when the sandbox is gone from the host
  agent's in-memory map but DB still says "running"
- Revert status to "running" on RPC failure
- Check ctx.Err() before writing response to avoid writing to dead
  connections when client disconnects during long snapshot operations

Delete auth fix:
- Block non-admin deletion of platform templates (team_id = all-zeros)
  at DELETE /v1/snapshots/{name} with 403, preventing file deletion
  before the team ownership check fails

Sparse dd:
- Add conv=sparse to dd in FlattenSnapshot so flattened images preserve
  sparseness (~200MB actual vs 5GB logical)

Default disk size:
- Change default disk_size_mb from 20GB to 5GB across migration,
  manager, service, build, and EnsureImageSizes
- Disable split-button dropdown arrow for platform templates in
  dashboard snapshots page (teams cannot delete platform templates)

internal/api/handlers_snapshots.go

@@ -69,6 +69,7 @@ type snapshotResponse struct {
 	MemoryMB  *int32 `json:"memory_mb,omitempty"`
 	SizeBytes int64  `json:"size_bytes"`
 	CreatedAt string `json:"created_at"`
+	Platform  bool   `json:"platform"`
 }
 
 func templateToResponse(t db.Template) snapshotResponse {
@@ -76,6 +77,7 @@ func templateToResponse(t db.Template) snapshotResponse {
 		Name:      t.Name,
 		Type:      t.Type,
 		SizeBytes: t.SizeBytes,
+		Platform:  t.TeamID == id.PlatformTeamID,
 	}
 	if t.Vcpus != 0 {
 		resp.VCPUs = &t.Vcpus
@@ -154,26 +156,43 @@ func (h *snapshotHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	resp, err := agent.CreateSnapshot(ctx, connect.NewRequest(&pb.CreateSnapshotRequest{
+	// Pre-mark sandbox as "paused" in DB BEFORE issuing the snapshot RPC.
+	// The host agent's CreateSnapshot removes the sandbox from its in-memory
+	// map immediately; if the reconciler fires during the flatten window and
+	// the DB still says "running", it will mark the sandbox "stopped".
+	if sb.Status == "running" {
+		if _, err := h.db.UpdateSandboxStatus(ctx, db.UpdateSandboxStatusParams{
+			ID: sandboxID, Status: "paused",
+		}); err != nil {
+			writeError(w, http.StatusInternalServerError, "db_error", "failed to update sandbox status")
+			return
+		}
+	}
+
+	// Use a detached context with a generous timeout so the snapshot completes
+	// even if the client disconnects (the flatten step can take 10-20s).
+	snapCtx, snapCancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer snapCancel()
+
+	resp, err := agent.CreateSnapshot(snapCtx, connect.NewRequest(&pb.CreateSnapshotRequest{
 		SandboxId: req.SandboxID,
 		Name:      req.Name,
 	}))
 	if err != nil {
+		// Snapshot failed — revert status back to what it was.
+		if sb.Status == "running" {
+			if _, dbErr := h.db.UpdateSandboxStatus(snapCtx, db.UpdateSandboxStatusParams{
+				ID: sandboxID, Status: "running",
+			}); dbErr != nil {
+				slog.Error("failed to revert sandbox status after snapshot error", "sandbox_id", req.SandboxID, "error", dbErr)
+			}
+		}
 		status, code, msg := agentErrToHTTP(err)
 		writeError(w, status, code, msg)
 		return
 	}
 
-	// Mark sandbox as paused (if it was running, it got paused by the snapshot).
-	if sb.Status != "paused" {
-		if _, err := h.db.UpdateSandboxStatus(ctx, db.UpdateSandboxStatusParams{
-			ID: sandboxID, Status: "paused",
-		}); err != nil {
-			slog.Error("failed to update sandbox status after snapshot", "sandbox_id", req.SandboxID, "error", err)
-		}
-	}
-
-	tmpl, err := h.db.InsertTemplate(ctx, db.InsertTemplateParams{
+	tmpl, err := h.db.InsertTemplate(snapCtx, db.InsertTemplateParams{
 		Name:      req.Name,
 		Type:      "snapshot",
 		Vcpus:     sb.Vcpus,
@@ -187,7 +206,12 @@ func (h *snapshotHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	h.audit.LogSnapshotCreate(r.Context(), ac, req.Name)
+	h.audit.LogSnapshotCreate(snapCtx, ac, req.Name)
+
+	if ctx.Err() != nil {
+		slog.Info("snapshot created but client disconnected before response", "name", req.Name)
+		return
+	}
 	writeJSON(w, http.StatusCreated, templateToResponse(tmpl))
 }
 
@@ -220,10 +244,16 @@ func (h *snapshotHandler) Delete(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	ac := auth.MustFromContext(ctx)
 
-	if _, err := h.db.GetTemplateByTeam(ctx, db.GetTemplateByTeamParams{Name: name, TeamID: ac.TeamID}); err != nil {
+	tmpl, err := h.db.GetTemplateByTeam(ctx, db.GetTemplateByTeamParams{Name: name, TeamID: ac.TeamID})
+	if err != nil {
 		writeError(w, http.StatusNotFound, "not_found", "template not found")
 		return
 	}
+	// Platform templates can only be deleted by admins via /v1/admin/templates.
+	if tmpl.TeamID == id.PlatformTeamID {
+		writeError(w, http.StatusForbidden, "forbidden", "platform templates cannot be deleted here")
+		return
+	}
 
 	if err := h.deleteSnapshotBroadcast(ctx, name); err != nil {
 		writeError(w, http.StatusInternalServerError, "agent_error", "failed to delete snapshot files")