Add disk_size_mb, auto-expand base images, admin templates endpoint

Disk sizing:
- Add disk_size_mb column to sandboxes table (default 20480 = 20GB)
- Add disk_size_mb to CreateSandboxRequest proto, passed through the
  full chain: service → RPC → host agent → sandbox manager → devicemapper
- devicemapper.CreateSnapshot takes separate cowSizeBytes param so the
  sparse CoW file can be sized independently from the origin
- EnsureImageSizes() runs at host agent startup: expands any base image
  smaller than 20GB via truncate + resize2fs (sparse, no extra physical
  disk). Sandboxes then get the full 20GB via fast dm-snapshot path
- FlattenRootfs shrinks output images with resize2fs -M so stored
  templates are compact; EnsureImageSizes re-expands on next startup

Admin templates visibility:
- Add GET /v1/admin/templates endpoint listing all templates across teams
- Frontend admin templates page uses listAdminTemplates() instead of
  team-scoped listSnapshots()
- Platform templates (team_id = all-zeros UUID) now visible to all teams:
  GetTemplateByTeam, ListTemplatesByTeam, ListTemplatesByTeamAndType
  queries include platform team_id in WHERE clause

db/migrations/20260310094104_initial.sql

@@ -144,6 +144,7 @@ CREATE TABLE sandboxes (
     vcpus          INTEGER NOT NULL DEFAULT 1,
     memory_mb      INTEGER NOT NULL DEFAULT 512,
     timeout_sec    INTEGER NOT NULL DEFAULT 300,
+    disk_size_mb   INTEGER NOT NULL DEFAULT 20480,
     guest_ip       TEXT NOT NULL DEFAULT '',
     host_ip        TEXT NOT NULL DEFAULT '',
     created_at     TIMESTAMPTZ NOT NULL DEFAULT NOW(),

db/queries/sandboxes.sql

@@ -1,6 +1,6 @@
 -- name: InsertSandbox :one
-INSERT INTO sandboxes (id, team_id, host_id, template, status, vcpus, memory_mb, timeout_sec)
-VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+INSERT INTO sandboxes (id, team_id, host_id, template, status, vcpus, memory_mb, timeout_sec, disk_size_mb)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
 RETURNING *;
 
 -- name: GetSandbox :one

db/queries/templates.sql

@@ -7,7 +7,8 @@ RETURNING *;
 SELECT * FROM templates WHERE name = $1;
 
 -- name: GetTemplateByTeam :one
-SELECT * FROM templates WHERE name = $1 AND team_id = $2;
+-- Platform templates (team_id = 00000000-...) are visible to all teams.
+SELECT * FROM templates WHERE name = $1 AND (team_id = $2 OR team_id = '00000000-0000-0000-0000-000000000000');
 
 -- name: ListTemplates :many
 SELECT * FROM templates ORDER BY created_at DESC;
@@ -16,10 +17,12 @@ SELECT * FROM templates ORDER BY created_at DESC;
 SELECT * FROM templates WHERE type = $1 ORDER BY created_at DESC;
 
 -- name: ListTemplatesByTeam :many
-SELECT * FROM templates WHERE team_id = $1 ORDER BY created_at DESC;
+-- Platform templates are visible to all teams.
+SELECT * FROM templates WHERE (team_id = $1 OR team_id = '00000000-0000-0000-0000-000000000000') ORDER BY created_at DESC;
 
 -- name: ListTemplatesByTeamAndType :many
-SELECT * FROM templates WHERE team_id = $1 AND type = $2 ORDER BY created_at DESC;
+-- Platform templates are visible to all teams.
+SELECT * FROM templates WHERE (team_id = $1 OR team_id = '00000000-0000-0000-0000-000000000000') AND type = $2 ORDER BY created_at DESC;
 
 -- name: DeleteTemplate :exec
 DELETE FROM templates WHERE name = $1;