Add UUID-based template IDs and team-scoped template directory layout

Introduces internal/layout package for centralized path construction,
migrates templates from name-based TEXT primary keys to UUID PKs with
team-scoped directories (WRENN_DIR/images/teams/{team_id}/{template_id}).
The built-in minimal template uses sentinel zero UUIDs. Proto messages
carry team_id + template_id alongside deprecated template name field.
Team deletion now cleans up template files across all hosts.

internal/models/sandbox.go

@@ -18,15 +18,16 @@ const (
 
 // Sandbox holds all state for a running sandbox on this host.
 type Sandbox struct {
-	ID           string
-	Status       SandboxStatus
-	Template     string
-	VCPUs        int
-	MemoryMB     int
-	TimeoutSec   int
-	SlotIndex    int
-	HostIP       net.IP
-	RootfsPath   string
-	CreatedAt    time.Time
-	LastActiveAt time.Time
+	ID             string
+	Status         SandboxStatus
+	TemplateTeamID [16]byte
+	TemplateID     [16]byte
+	VCPUs          int
+	MemoryMB       int
+	TimeoutSec     int
+	SlotIndex      int
+	HostIP         net.IP
+	RootfsPath     string
+	CreatedAt      time.Time
+	LastActiveAt   time.Time
 }