Add BYOC page, admin section, and is_byoc team visibility gating

- Frontend: BYOC hosts page (/dashboard/byoc) with register/delete flows,
  shimmer loading, pulsing online status, animated token reveal checkmark
- Frontend: Admin section (/admin/hosts) with platform + BYOC tabs, stat
  pills, skeleton loading, slide-in animations for new rows
- Frontend: AdminSidebar component with accent top bar and admin pill badge
- Frontend: BYOC nav item shown only when team.is_byoc is true (derived
  from teams store, not JWT); disabled for members
- Frontend: Admin shield button in Sidebar, visible only to platform admins
- Backend: is_admin in JWT claims + requireAdmin middleware (DB-validated)
- Backend: is_byoc added to teamResponse so frontend derives visibility
  from fresh team data rather than stale JWT fields
- Backend: SetBYOC admin endpoint (PUT /v1/admin/teams/{id}/byoc)
- Backend: Admin hosts list enriches BYOC entries with team_name
- Host agent: load .env file via godotenv on startup

cmd/host-agent/main.go

@@ -8,9 +8,12 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"sync"
 	"syscall"
 	"time"
 
+	"github.com/joho/godotenv"
+
 	"git.omukk.dev/wrenn/sandbox/internal/devicemapper"
 	"git.omukk.dev/wrenn/sandbox/internal/hostagent"
 	"git.omukk.dev/wrenn/sandbox/internal/sandbox"
@@ -18,6 +21,9 @@ import (
 )
 
 func main() {
+	// Best-effort load — missing .env file is fine.
+	_ = godotenv.Load()
+
 	registrationToken := flag.String("register", "", "One-time registration token from the control plane (required on first run)")
 	advertiseAddr := flag.String("address", "", "Externally-reachable address (ip:port) for this host agent")
 	flag.Parse()
@@ -87,41 +93,57 @@ func main() {
 
 	slog.Info("host registered", "host_id", hostID)
 
-	// Start heartbeat loop. On CP rejection: try JWT refresh. If that fails,
-	// pause all running sandboxes to ensure they're not left orphaned.
-	hostagent.StartHeartbeat(ctx, cpURL, tokenFile, hostID, 30*time.Second, func() {
-		pauseCtx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
-		defer cancel()
-		mgr.PauseAll(pauseCtx)
-	})
+	// httpServer is declared here so the shutdown func can reference it.
+	httpServer := &http.Server{Addr: listenAddr}
 
-	srv := hostagent.NewServer(mgr)
+	// doShutdown is the single shutdown path. sync.Once ensures mgr.Shutdown
+	// and httpServer.Shutdown are each called exactly once regardless of
+	// whether shutdown is triggered by a signal, a heartbeat 404, or the
+	// Terminate RPC.
+	var shutdownOnce sync.Once
+	doShutdown := func(reason string) {
+		shutdownOnce.Do(func() {
+			slog.Info("shutting down", "reason", reason)
+			cancel()
+			shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer shutdownCancel()
+			mgr.Shutdown(shutdownCtx)
+			if err := httpServer.Shutdown(shutdownCtx); err != nil {
+				slog.Error("http server shutdown error", "error", err)
+			}
+		})
+	}
+
+	srv := hostagent.NewServer(mgr, func() {
+		doShutdown("Terminate RPC received")
+	})
 	path, handler := hostagentv1connect.NewHostAgentServiceHandler(srv)
 
 	mux := http.NewServeMux()
 	mux.Handle(path, handler)
+	httpServer.Handler = mux
 
-	httpServer := &http.Server{
-		Addr:    listenAddr,
-		Handler: mux,
-	}
+	// Start heartbeat loop. Handler must be set before this because the
+	// immediate beat can trigger doShutdown → httpServer.Shutdown synchronously.
+	hostagent.StartHeartbeat(ctx, cpURL, tokenFile, hostID, 30*time.Second,
+		// pauseAll: called on 3 consecutive network failures.
+		func() {
+			pauseCtx, pauseCancel := context.WithTimeout(context.Background(), 2*time.Minute)
+			defer pauseCancel()
+			mgr.PauseAll(pauseCtx)
+		},
+		// onDeleted: called when CP returns 404 (host was deleted).
+		func() {
+			doShutdown("host deleted from CP")
+		},
+	)
 
-	// Graceful shutdown on signal.
+	// Graceful shutdown on SIGINT/SIGTERM.
 	sigCh := make(chan os.Signal, 1)
 	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
 	go func() {
 		sig := <-sigCh
-		slog.Info("received signal, shutting down", "signal", sig)
-		cancel()
-
-		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 30*time.Second)
-		defer shutdownCancel()
-
-		mgr.Shutdown(shutdownCtx)
-
-		if err := httpServer.Shutdown(shutdownCtx); err != nil {
-			slog.Error("http server shutdown error", "error", err)
-		}
+		doShutdown("signal: " + sig.String())
 	}()
 
 	slog.Info("host agent starting", "addr", listenAddr, "host_id", hostID)