Implement host registration, JWT refresh tokens, and multi-host scheduling

Replaces the hardcoded CP_HOST_AGENT_ADDR single-agent setup with a
DB-driven registration system supporting multiple host agents (BYOC).

Key changes:
- Host agents register via one-time token, receive a 7-day JWT + 60-day
  refresh token; heartbeat loop auto-refreshes on 401/403 and pauses all
  sandboxes if refresh fails
- HostClientPool: lazy Connect RPC client cache keyed by host ID, replacing
  the single static agent client throughout the API and service layers
- RoundRobinScheduler: picks an online host for each new sandbox via
  ListActiveHosts; extensible for future scheduling strategies
- HostMonitor (replaces Reconciler): passive heartbeat staleness check marks
  hosts unreachable and sandboxes missing after 90s; active reconciliation
  per online host restores missing-but-alive sandboxes and stops orphans
- Graceful host delete: returns 409 with affected sandbox list without
  ?force=true; force-delete destroys sandboxes then evicts pool client
- Snapshot delete broadcasts to all online hosts (templates have no host_id)
- sandbox.Manager.PauseAll: pauses all running VMs on CP connectivity loss
- New migration: host_refresh_tokens table with token rotation (issue-then-
  revoke ordering to prevent lockout on mid-rotation crash)
- New sandbox status 'missing' (reversible, unlike 'stopped') and host
  status 'unreachable'; both reflected in OpenAPI spec
- Fix: refresh token auth failure now returns 401 (was 400 via generic
  'invalid' substring match in serviceErrToHTTP)

db/migrations/20260324120214_host_refresh_tokens.sql

@@ -0,0 +1,19 @@
+-- +goose Up
+
+-- Refresh tokens for host agent JWT rotation.
+-- Hosts exchange a refresh token for a new short-lived JWT + new refresh token (rotation).
+-- Refresh tokens expire after 60 days; hosts must re-register with a new one-time token after that.
+CREATE TABLE host_refresh_tokens (
+    id         TEXT PRIMARY KEY,
+    host_id    TEXT NOT NULL REFERENCES hosts(id) ON DELETE CASCADE,
+    token_hash TEXT NOT NULL UNIQUE,   -- SHA-256 hex of the opaque token
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    revoked_at TIMESTAMPTZ             -- NULL = active; set on rotation or host delete
+);
+
+CREATE INDEX idx_host_refresh_tokens_host ON host_refresh_tokens(host_id);
+
+-- +goose Down
+
+DROP TABLE host_refresh_tokens;

db/queries/host_refresh_tokens.sql

@@ -0,0 +1,19 @@
+-- name: InsertHostRefreshToken :one
+INSERT INTO host_refresh_tokens (id, host_id, token_hash, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING *;
+
+-- name: GetHostRefreshTokenByHash :one
+SELECT * FROM host_refresh_tokens
+WHERE token_hash = $1 AND revoked_at IS NULL AND expires_at > NOW();
+
+-- name: RevokeHostRefreshToken :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW() WHERE id = $1;
+
+-- name: RevokeHostRefreshTokensByHost :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW()
+WHERE host_id = $1 AND revoked_at IS NULL;
+
+-- name: DeleteExpiredHostRefreshTokens :exec
+DELETE FROM host_refresh_tokens
+WHERE expires_at < NOW() OR revoked_at IS NOT NULL;

db/queries/hosts.sql

@@ -67,3 +67,18 @@ SELECT * FROM host_tokens WHERE host_id = $1 ORDER BY created_at DESC;
 
 -- name: GetHostByTeam :one
 SELECT * FROM hosts WHERE id = $1 AND team_id = $2;
+
+-- name: ListActiveHosts :many
+-- Returns all hosts that have completed registration (not pending/offline).
+SELECT * FROM hosts WHERE status NOT IN ('pending', 'offline') ORDER BY created_at;
+
+-- name: UpdateHostHeartbeatAndStatus :exec
+-- Updates last_heartbeat_at and transitions unreachable hosts back to online.
+UPDATE hosts
+SET last_heartbeat_at = NOW(),
+    status            = CASE WHEN status = 'unreachable' THEN 'online' ELSE status END,
+    updated_at        = NOW()
+WHERE id = $1;
+
+-- name: MarkHostUnreachable :exec
+UPDATE hosts SET status = 'unreachable', updated_at = NOW() WHERE id = $1;

db/queries/sandboxes.sql

@@ -56,3 +56,20 @@ WHERE id = ANY($1::text[]);
 SELECT * FROM sandboxes
 WHERE team_id = $1 AND status IN ('running', 'paused', 'starting')
 ORDER BY created_at DESC;
+
+-- name: MarkSandboxesMissingByHost :exec
+-- Called when the host monitor marks a host unreachable.
+-- Marks running/starting/pending sandboxes on that host as 'missing' so users see
+-- the sandbox is not currently reachable, without permanently losing the record.
+UPDATE sandboxes
+SET status       = 'missing',
+    last_updated = NOW()
+WHERE host_id = $1 AND status IN ('running', 'starting', 'pending');
+
+-- name: BulkRestoreRunning :exec
+-- Called by the reconciler when a host comes back online and its sandboxes are
+-- confirmed alive. Restores only sandboxes that are in 'missing' state.
+UPDATE sandboxes
+SET status       = 'running',
+    last_updated = NOW()
+WHERE id = ANY($1::text[]) AND status = 'missing';