Add disk_size_mb, auto-expand base images, admin templates endpoint

Disk sizing:
- Add disk_size_mb column to sandboxes table (default 20480 = 20GB)
- Add disk_size_mb to CreateSandboxRequest proto, passed through the
  full chain: service → RPC → host agent → sandbox manager → devicemapper
- devicemapper.CreateSnapshot takes separate cowSizeBytes param so the
  sparse CoW file can be sized independently from the origin
- EnsureImageSizes() runs at host agent startup: expands any base image
  smaller than 20GB via truncate + resize2fs (sparse, no extra physical
  disk). Sandboxes then get the full 20GB via fast dm-snapshot path
- FlattenRootfs shrinks output images with resize2fs -M so stored
  templates are compact; EnsureImageSizes re-expands on next startup

Admin templates visibility:
- Add GET /v1/admin/templates endpoint listing all templates across teams
- Frontend admin templates page uses listAdminTemplates() instead of
  team-scoped listSnapshots()
- Platform templates (team_id = all-zeros UUID) now visible to all teams:
  GetTemplateByTeam, ListTemplatesByTeam, ListTemplatesByTeamAndType
  queries include platform team_id in WHERE clause

internal/service/build.go

@@ -199,7 +199,8 @@ func (s *BuildService) executeBuild(ctx context.Context, buildIDStr string) {
 		Template:   build.BaseTemplate,
 		Vcpus:      build.Vcpus,
 		MemoryMb:   build.MemoryMb,
-		TimeoutSec: 0, // no auto-pause for builds
+		TimeoutSec: 0,     // no auto-pause for builds
+		DiskSizeMb: 20480, // 20 GB for template builds
 	}))
 	if err != nil {
 		s.failBuild(ctx, buildID, fmt.Sprintf("create sandbox failed: %v", err))

internal/service/sandbox.go

@@ -32,6 +32,7 @@ type SandboxCreateParams struct {
 	VCPUs      int32
 	MemoryMB   int32
 	TimeoutSec int32
+	DiskSizeMB int32
 }
 
 // agentForSandbox looks up the host for the given sandbox and returns a client.
@@ -77,6 +78,9 @@ func (s *SandboxService) Create(ctx context.Context, p SandboxCreateParams) (db.
 	if p.MemoryMB <= 0 {
 		p.MemoryMB = 512
 	}
+	if p.DiskSizeMB <= 0 {
+		p.DiskSizeMB = 20480 // 20 GB default
+	}
 
 	// If the template is a snapshot, use its baked-in vcpus/memory.
 	if tmpl, err := s.DB.GetTemplateByTeam(ctx, db.GetTemplateByTeamParams{Name: p.Template, TeamID: p.TeamID}); err == nil && tmpl.Type == "snapshot" {
@@ -117,6 +121,7 @@ func (s *SandboxService) Create(ctx context.Context, p SandboxCreateParams) (db.
 		Vcpus:      p.VCPUs,
 		MemoryMb:   p.MemoryMB,
 		TimeoutSec: p.TimeoutSec,
+		DiskSizeMb: p.DiskSizeMB,
 	}); err != nil {
 		return db.Sandbox{}, fmt.Errorf("insert sandbox: %w", err)
 	}
@@ -127,6 +132,7 @@ func (s *SandboxService) Create(ctx context.Context, p SandboxCreateParams) (db.
 		Vcpus:      p.VCPUs,
 		MemoryMb:   p.MemoryMB,
 		TimeoutSec: p.TimeoutSec,
+		DiskSizeMb: p.DiskSizeMB,
 	}))
 	if err != nil {
 		if _, dbErr := s.DB.UpdateSandboxStatus(ctx, db.UpdateSandboxStatusParams{