Add BYOC page, admin section, and is_byoc team visibility gating

- Frontend: BYOC hosts page (/dashboard/byoc) with register/delete flows,
  shimmer loading, pulsing online status, animated token reveal checkmark
- Frontend: Admin section (/admin/hosts) with platform + BYOC tabs, stat
  pills, skeleton loading, slide-in animations for new rows
- Frontend: AdminSidebar component with accent top bar and admin pill badge
- Frontend: BYOC nav item shown only when team.is_byoc is true (derived
  from teams store, not JWT); disabled for members
- Frontend: Admin shield button in Sidebar, visible only to platform admins
- Backend: is_admin in JWT claims + requireAdmin middleware (DB-validated)
- Backend: is_byoc added to teamResponse so frontend derives visibility
  from fresh team data rather than stale JWT fields
- Backend: SetBYOC admin endpoint (PUT /v1/admin/teams/{id}/byoc)
- Backend: Admin hosts list enriches BYOC entries with team_name
- Host agent: load .env file via godotenv on startup

proto/hostagent/hostagent.proto

@@ -49,6 +49,11 @@ service HostAgentService {
   // PingSandbox resets the inactivity timer for a running sandbox.
   rpc PingSandbox(PingSandboxRequest) returns (PingSandboxResponse);
 
+  // Terminate instructs the host agent to destroy all sandboxes and exit.
+  // Called by the control plane immediately when a host is deleted so the
+  // agent shuts down without waiting for the next heartbeat cycle.
+  rpc Terminate(TerminateRequest) returns (TerminateResponse);
+
 }
 
 message CreateSandboxRequest {
@@ -236,3 +241,10 @@ message PingSandboxRequest {
 
 message PingSandboxResponse {}
 
+
+
+// ── Terminate ────────────────────────────────────────────────────────
+
+message TerminateRequest {}
+
+message TerminateResponse {}