Add disk_size_mb, auto-expand base images, admin templates endpoint

Disk sizing:
- Add disk_size_mb column to sandboxes table (default 20480 = 20GB)
- Add disk_size_mb to CreateSandboxRequest proto, passed through the
  full chain: service → RPC → host agent → sandbox manager → devicemapper
- devicemapper.CreateSnapshot takes separate cowSizeBytes param so the
  sparse CoW file can be sized independently from the origin
- EnsureImageSizes() runs at host agent startup: expands any base image
  smaller than 20GB via truncate + resize2fs (sparse, no extra physical
  disk). Sandboxes then get the full 20GB via fast dm-snapshot path
- FlattenRootfs shrinks output images with resize2fs -M so stored
  templates are compact; EnsureImageSizes re-expands on next startup

Admin templates visibility:
- Add GET /v1/admin/templates endpoint listing all templates across teams
- Frontend admin templates page uses listAdminTemplates() instead of
  team-scoped listSnapshots()
- Platform templates (team_id = all-zeros UUID) now visible to all teams:
  GetTemplateByTeam, ListTemplatesByTeam, ListTemplatesByTeamAndType
  queries include platform team_id in WHERE clause

internal/api/handlers_builds.go

@@ -17,10 +17,11 @@ import (
 
 type buildHandler struct {
 	svc *service.BuildService
+	db  *db.Queries
 }
 
-func newBuildHandler(svc *service.BuildService) *buildHandler {
-	return &buildHandler{svc: svc}
+func newBuildHandler(svc *service.BuildService, db *db.Queries) *buildHandler {
+	return &buildHandler{svc: svc, db: db}
 }
 
 type createBuildRequest struct {
@@ -165,3 +166,39 @@ func (h *buildHandler) Get(w http.ResponseWriter, r *http.Request) {
 
 	writeJSON(w, http.StatusOK, buildToResponse(build))
 }
+
+// ListTemplates handles GET /v1/admin/templates — returns all templates across all teams.
+func (h *buildHandler) ListTemplates(w http.ResponseWriter, r *http.Request) {
+	templates, err := h.db.ListTemplates(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, "db_error", "failed to list templates")
+		return
+	}
+
+	type templateResponse struct {
+		Name      string  `json:"name"`
+		Type      string  `json:"type"`
+		VCPUs     int32   `json:"vcpus"`
+		MemoryMB  int32   `json:"memory_mb"`
+		SizeBytes int64   `json:"size_bytes"`
+		TeamID    string  `json:"team_id"`
+		CreatedAt string  `json:"created_at"`
+	}
+
+	resp := make([]templateResponse, len(templates))
+	for i, t := range templates {
+		resp[i] = templateResponse{
+			Name:      t.Name,
+			Type:      t.Type,
+			VCPUs:     t.Vcpus,
+			MemoryMB:  t.MemoryMb,
+			SizeBytes: t.SizeBytes,
+			TeamID:    id.FormatTeamID(t.TeamID),
+		}
+		if t.CreatedAt.Valid {
+			resp[i].CreatedAt = t.CreatedAt.Time.Format(time.RFC3339)
+		}
+	}
+
+	writeJSON(w, http.StatusOK, resp)
+}

internal/api/server.go

@@ -67,7 +67,7 @@ func New(
 	auditH := newAuditHandler(auditSvc)
 	statsH := newStatsHandler(statsSvc)
 	metricsH := newSandboxMetricsHandler(queries, pool)
-	buildH := newBuildHandler(buildSvc)
+	buildH := newBuildHandler(buildSvc, queries)
 
 	// OpenAPI spec and docs.
 	r.Get("/openapi.yaml", serveOpenAPI)
@@ -177,6 +177,7 @@ func New(
 		r.Use(requireJWT(jwtSecret))
 		r.Use(requireAdmin(queries))
 		r.Put("/teams/{id}/byoc", teamH.SetBYOC)
+		r.Get("/templates", buildH.ListTemplates)
 		r.Post("/builds", buildH.Create)
 		r.Get("/builds", buildH.List)
 		r.Get("/builds/{id}", buildH.Get)