Implement host registration, JWT refresh tokens, and multi-host scheduling

Replaces the hardcoded CP_HOST_AGENT_ADDR single-agent setup with a
DB-driven registration system supporting multiple host agents (BYOC).

Key changes:
- Host agents register via one-time token, receive a 7-day JWT + 60-day
  refresh token; heartbeat loop auto-refreshes on 401/403 and pauses all
  sandboxes if refresh fails
- HostClientPool: lazy Connect RPC client cache keyed by host ID, replacing
  the single static agent client throughout the API and service layers
- RoundRobinScheduler: picks an online host for each new sandbox via
  ListActiveHosts; extensible for future scheduling strategies
- HostMonitor (replaces Reconciler): passive heartbeat staleness check marks
  hosts unreachable and sandboxes missing after 90s; active reconciliation
  per online host restores missing-but-alive sandboxes and stops orphans
- Graceful host delete: returns 409 with affected sandbox list without
  ?force=true; force-delete destroys sandboxes then evicts pool client
- Snapshot delete broadcasts to all online hosts (templates have no host_id)
- sandbox.Manager.PauseAll: pauses all running VMs on CP connectivity loss
- New migration: host_refresh_tokens table with token rotation (issue-then-
  revoke ordering to prevent lockout on mid-rotation crash)
- New sandbox status 'missing' (reversible, unlike 'stopped') and host
  status 'unreachable'; both reflected in OpenAPI spec
- Fix: refresh token auth failure now returns 401 (was 400 via generic
  'invalid' substring match in serviceErrToHTTP)

internal/db/host_refresh_tokens.sql.go

@@ -0,0 +1,92 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: host_refresh_tokens.sql
+
+package db
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const deleteExpiredHostRefreshTokens = `-- name: DeleteExpiredHostRefreshTokens :exec
+DELETE FROM host_refresh_tokens
+WHERE expires_at < NOW() OR revoked_at IS NOT NULL
+`
+
+func (q *Queries) DeleteExpiredHostRefreshTokens(ctx context.Context) error {
+	_, err := q.db.Exec(ctx, deleteExpiredHostRefreshTokens)
+	return err
+}
+
+const getHostRefreshTokenByHash = `-- name: GetHostRefreshTokenByHash :one
+SELECT id, host_id, token_hash, expires_at, created_at, revoked_at FROM host_refresh_tokens
+WHERE token_hash = $1 AND revoked_at IS NULL AND expires_at > NOW()
+`
+
+func (q *Queries) GetHostRefreshTokenByHash(ctx context.Context, tokenHash string) (HostRefreshToken, error) {
+	row := q.db.QueryRow(ctx, getHostRefreshTokenByHash, tokenHash)
+	var i HostRefreshToken
+	err := row.Scan(
+		&i.ID,
+		&i.HostID,
+		&i.TokenHash,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.RevokedAt,
+	)
+	return i, err
+}
+
+const insertHostRefreshToken = `-- name: InsertHostRefreshToken :one
+INSERT INTO host_refresh_tokens (id, host_id, token_hash, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING id, host_id, token_hash, expires_at, created_at, revoked_at
+`
+
+type InsertHostRefreshTokenParams struct {
+	ID        string             `json:"id"`
+	HostID    string             `json:"host_id"`
+	TokenHash string             `json:"token_hash"`
+	ExpiresAt pgtype.Timestamptz `json:"expires_at"`
+}
+
+func (q *Queries) InsertHostRefreshToken(ctx context.Context, arg InsertHostRefreshTokenParams) (HostRefreshToken, error) {
+	row := q.db.QueryRow(ctx, insertHostRefreshToken,
+		arg.ID,
+		arg.HostID,
+		arg.TokenHash,
+		arg.ExpiresAt,
+	)
+	var i HostRefreshToken
+	err := row.Scan(
+		&i.ID,
+		&i.HostID,
+		&i.TokenHash,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.RevokedAt,
+	)
+	return i, err
+}
+
+const revokeHostRefreshToken = `-- name: RevokeHostRefreshToken :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) RevokeHostRefreshToken(ctx context.Context, id string) error {
+	_, err := q.db.Exec(ctx, revokeHostRefreshToken, id)
+	return err
+}
+
+const revokeHostRefreshTokensByHost = `-- name: RevokeHostRefreshTokensByHost :exec
+UPDATE host_refresh_tokens SET revoked_at = NOW()
+WHERE host_id = $1 AND revoked_at IS NULL
+`
+
+func (q *Queries) RevokeHostRefreshTokensByHost(ctx context.Context, hostID string) error {
+	_, err := q.db.Exec(ctx, revokeHostRefreshTokensByHost, hostID)
+	return err
+}