Add sandbox snapshot and restore with UFFD lazy memory loading

Implement full snapshot lifecycle: pause (snapshot + free resources),
resume (UFFD-based lazy restore), and named snapshot templates that
can spawn new sandboxes from frozen VM state.

Key changes:
- Snapshot header system with generational diff mapping (inspired by e2b)
- UFFD server for lazy page fault handling during snapshot restore
- Stable rootfs symlink path (/tmp/fc-vm/) for snapshot compatibility
- Templates DB table and CRUD API endpoints (POST/GET/DELETE /v1/snapshots)
- CreateSnapshot/DeleteSnapshot RPCs in hostagent proto
- Reconciler excludes paused sandboxes (expected absent from host agent)
- Snapshot templates lock vcpus/memory to baked-in values
- Proper cleanup of uffd sockets and pause snapshot files on destroy

internal/api/handlers_exec_stream.go

@@ -44,7 +44,7 @@ type wsStopMsg struct {
 
 // wsOutMsg is sent by the server for process events.
 type wsOutMsg struct {
-	Type     string `json:"type"`               // "start", "stdout", "stderr", "exit", "error"
+	Type     string `json:"type"`                // "start", "stdout", "stderr", "exit", "error"
 	PID      uint32 `json:"pid,omitempty"`       // only for "start"
 	Data     string `json:"data,omitempty"`      // only for "stdout", "stderr", "error"
 	ExitCode *int32 `json:"exit_code,omitempty"` // only for "exit"