Add BYOC page, admin section, and is_byoc team visibility gating

- Frontend: BYOC hosts page (/dashboard/byoc) with register/delete flows,
  shimmer loading, pulsing online status, animated token reveal checkmark
- Frontend: Admin section (/admin/hosts) with platform + BYOC tabs, stat
  pills, skeleton loading, slide-in animations for new rows
- Frontend: AdminSidebar component with accent top bar and admin pill badge
- Frontend: BYOC nav item shown only when team.is_byoc is true (derived
  from teams store, not JWT); disabled for members
- Frontend: Admin shield button in Sidebar, visible only to platform admins
- Backend: is_admin in JWT claims + requireAdmin middleware (DB-validated)
- Backend: is_byoc added to teamResponse so frontend derives visibility
  from fresh team data rather than stale JWT fields
- Backend: SetBYOC admin endpoint (PUT /v1/admin/teams/{id}/byoc)
- Backend: Admin hosts list enriches BYOC entries with team_name
- Host agent: load .env file via godotenv on startup

internal/scheduler/round_robin.go

@@ -12,11 +12,13 @@ import (
 // different strategies (round-robin, least-loaded, tag-based, etc.).
 type HostScheduler interface {
 	// SelectHost returns a host that can accept a new sandbox.
-	// Returns an error if no suitable host is available.
-	SelectHost(ctx context.Context) (db.Host, error)
+	// For BYOC teams (isByoc=true), only online BYOC hosts belonging to teamID
+	// are considered. For non-BYOC teams, only online regular (platform) hosts
+	// are considered. Returns an error if no suitable host is available.
+	SelectHost(ctx context.Context, teamID string, isByoc bool) (db.Host, error)
 }
 
-// RoundRobinScheduler cycles through online hosts in round-robin order.
+// RoundRobinScheduler cycles through eligible online hosts in round-robin order.
 // It re-fetches the host list on every call so that newly registered or
 // recovered hosts are considered immediately.
 type RoundRobinScheduler struct {
@@ -29,23 +31,39 @@ func NewRoundRobinScheduler(queries *db.Queries) *RoundRobinScheduler {
 	return &RoundRobinScheduler{db: queries}
 }
 
-// SelectHost returns the next online host in round-robin order.
-func (s *RoundRobinScheduler) SelectHost(ctx context.Context) (db.Host, error) {
+// SelectHost returns the next eligible online host in round-robin order.
+func (s *RoundRobinScheduler) SelectHost(ctx context.Context, teamID string, isByoc bool) (db.Host, error) {
 	hosts, err := s.db.ListActiveHosts(ctx)
 	if err != nil {
 		return db.Host{}, fmt.Errorf("list hosts: %w", err)
 	}
 
-	var online []db.Host
+	var eligible []db.Host
 	for _, h := range hosts {
-		if h.Status == "online" && h.Address.Valid && h.Address.String != "" {
-			online = append(online, h)
+		if h.Status != "online" || !h.Address.Valid || h.Address.String == "" {
+			continue
 		}
+		if isByoc {
+			// BYOC team: only use hosts belonging to this team.
+			if h.Type != "byoc" || !h.TeamID.Valid || h.TeamID.String != teamID {
+				continue
+			}
+		} else {
+			// Non-BYOC team: only use platform (regular) hosts.
+			if h.Type != "regular" {
+				continue
+			}
+		}
+		eligible = append(eligible, h)
 	}
-	if len(online) == 0 {
-		return db.Host{}, fmt.Errorf("no online hosts available")
+
+	if len(eligible) == 0 {
+		if isByoc {
+			return db.Host{}, fmt.Errorf("no online BYOC hosts available for team")
+		}
+		return db.Host{}, fmt.Errorf("no online platform hosts available")
 	}
 
 	idx := s.counter.Add(1) - 1
-	return online[int(idx%int64(len(online)))], nil
+	return eligible[int(idx%int64(len(eligible)))], nil
 }