Add disk_size_mb, auto-expand base images, admin templates endpoint

Disk sizing:
- Add disk_size_mb column to sandboxes table (default 20480 = 20GB)
- Add disk_size_mb to CreateSandboxRequest proto, passed through the
  full chain: service → RPC → host agent → sandbox manager → devicemapper
- devicemapper.CreateSnapshot takes separate cowSizeBytes param so the
  sparse CoW file can be sized independently from the origin
- EnsureImageSizes() runs at host agent startup: expands any base image
  smaller than 20GB via truncate + resize2fs (sparse, no extra physical
  disk). Sandboxes then get the full 20GB via fast dm-snapshot path
- FlattenRootfs shrinks output images with resize2fs -M so stored
  templates are compact; EnsureImageSizes re-expands on next startup

Admin templates visibility:
- Add GET /v1/admin/templates endpoint listing all templates across teams
- Frontend admin templates page uses listAdminTemplates() instead of
  team-scoped listSnapshots()
- Platform templates (team_id = all-zeros UUID) now visible to all teams:
  GetTemplateByTeam, ListTemplatesByTeam, ListTemplatesByTeamAndType
  queries include platform team_id in WHERE clause

frontend/src/routes/admin/templates/+page.svelte

@@ -3,12 +3,14 @@
 	import { onMount, onDestroy } from 'svelte';
 	import { toast } from '$lib/toast.svelte';
 	import { formatDate, timeAgo } from '$lib/utils/format';
-	import { listSnapshots, deleteSnapshot, type Snapshot } from '$lib/api/capsules';
+	import { deleteSnapshot } from '$lib/api/capsules';
 	import {
 		listBuilds,
 		createBuild,
+		listAdminTemplates,
 		type Build,
-		type BuildLogEntry
+		type BuildLogEntry,
+		type AdminTemplate
 	} from '$lib/api/builds';
 
 	let collapsed = $state(
@@ -20,7 +22,7 @@
 	let activeTab = $state<'templates' | 'builds'>('templates');
 
 	// Templates state
-	let templates = $state<Snapshot[]>([]);
+	let templates = $state<AdminTemplate[]>([]);
 	let templatesLoading = $state(true);
 	let templatesError = $state<string | null>(null);
 
@@ -38,7 +40,7 @@
 	let expandedSteps = $state<Set<number>>(new Set());
 
 	// Delete template state
-	let deleteTarget = $state<Snapshot | null>(null);
+	let deleteTarget = $state<AdminTemplate | null>(null);
 	let deleting = $state(false);
 	let deleteError = $state<string | null>(null);
 
@@ -64,7 +66,7 @@
 	async function fetchTemplates() {
 		templatesLoading = true;
 		templatesError = null;
-		const result = await listSnapshots();
+		const result = await listAdminTemplates();
 		if (result.ok) {
 			templates = result.data;
 		} else {