Add sandbox snapshot and restore with UFFD lazy memory loading

Implement full snapshot lifecycle: pause (snapshot + free resources),
resume (UFFD-based lazy restore), and named snapshot templates that
can spawn new sandboxes from frozen VM state.

Key changes:
- Snapshot header system with generational diff mapping (inspired by e2b)
- UFFD server for lazy page fault handling during snapshot restore
- Stable rootfs symlink path (/tmp/fc-vm/) for snapshot compatibility
- Templates DB table and CRUD API endpoints (POST/GET/DELETE /v1/snapshots)
- CreateSnapshot/DeleteSnapshot RPCs in hostagent proto
- Reconciler excludes paused sandboxes (expected absent from host agent)
- Snapshot templates lock vcpus/memory to baked-in values
- Proper cleanup of uffd sockets and pause snapshot files on destroy

internal/vm/fc.go

@@ -95,7 +95,7 @@ func (c *fcClient) setNetworkInterface(ctx context.Context, ifaceID, tapName, ma
 // setMachineConfig configures vCPUs, memory, and other machine settings.
 func (c *fcClient) setMachineConfig(ctx context.Context, vcpus, memMB int) error {
 	return c.do(ctx, http.MethodPut, "/machine-config", map[string]any{
-		"vcpu_count":  vcpus,
+		"vcpu_count":   vcpus,
 		"mem_size_mib": memMB,
 		"smt":          false,
 	})
@@ -131,7 +131,7 @@ func (c *fcClient) createSnapshot(ctx context.Context, snapPath, memPath string)
 	})
 }
 
-// loadSnapshot loads a VM snapshot.
+// loadSnapshot loads a VM snapshot from a file-backed memory image.
 func (c *fcClient) loadSnapshot(ctx context.Context, snapPath, memPath string) error {
 	return c.do(ctx, http.MethodPut, "/snapshot/load", map[string]any{
 		"snapshot_path": snapPath,
@@ -139,3 +139,17 @@ func (c *fcClient) loadSnapshot(ctx context.Context, snapPath, memPath string) e
 		"resume_vm":     false,
 	})
 }
+
+// loadSnapshotWithUffd loads a VM snapshot using a UFFD socket for
+// lazy memory loading. Firecracker will connect to the socket and
+// send the uffd fd + memory region mappings.
+func (c *fcClient) loadSnapshotWithUffd(ctx context.Context, snapPath, uffdSocketPath string) error {
+	return c.do(ctx, http.MethodPut, "/snapshot/load", map[string]any{
+		"snapshot_path": snapPath,
+		"resume_vm":     false,
+		"mem_backend": map[string]any{
+			"backend_type": "Uffd",
+			"backend_path": uffdSocketPath,
+		},
+	})
+}