WIP: Add HTTP proxy endpoint to host agent

Add /proxy/{sandbox_id}/{port}/* handler that reverse-proxies HTTP
requests to services running inside sandbox VMs. The sandbox's host IP
(10.11.0.{idx}) is used as the upstream target.

Includes port validation (1-65535) and shared HTTP transport for
connection pooling. Supports WebSocket upgrades for protocols like
Jupyter's streaming API.

This is an intermediate state — needs further work for the full code
interpreter feature.

cmd/host-agent/main.go

@@ -119,8 +119,11 @@ func main() {
 	})
 	path, handler := hostagentv1connect.NewHostAgentServiceHandler(srv)
 
+	proxyHandler := hostagent.NewProxyHandler(mgr)
+
 	mux := http.NewServeMux()
 	mux.Handle(path, handler)
+	mux.Handle("/proxy/", proxyHandler)
 	httpServer.Handler = mux
 
 	// Start heartbeat loop. Handler must be set before this because the