WIP: Add sandbox proxy catch-all to control plane

Add SandboxProxyWrapper that intercepts requests with Host headers
matching {port}-{sandbox_id}.{domain} and proxies them through the
owning host agent's /proxy endpoint.

Authentication is via X-API-Key only (no JWT). The API key's team must
own the sandbox. Export EnsureScheme from lifecycle package for reuse.

Request flow: SDK -> Caddy -> CP catch-all -> Host Agent -> sandbox VM.

This is an intermediate state — needs further work for the full code
interpreter feature.

cmd/control-plane/main.go

@@ -98,9 +98,14 @@ func main() {
 	sampler := api.NewMetricsSampler(queries, 10*time.Second)
 	sampler.Start(ctx)
 
+	// Wrap the API handler with the sandbox proxy so that requests with
+	// {port}-{sandbox_id}.{domain} Host headers are routed to the sandbox's
+	// host agent. All other requests pass through to the normal API router.
+	proxyWrapper := api.NewSandboxProxyWrapper(srv.Handler(), queries, hostPool)
+
 	httpServer := &http.Server{
 		Addr:    cfg.ListenAddr,
-		Handler: srv.Handler(),
+		Handler: proxyWrapper,
 	}
 
 	// Graceful shutdown on signal.