Port envd from e2b with internalized shared packages and Connect RPC

- Copy envd source from e2b-dev/infra, internalize shared dependencies
  into envd/internal/shared/ (keys, filesystem, id, smap, utils)
- Switch from gRPC to Connect RPC for all envd services
- Update module paths to git.omukk.dev/wrenn/{sandbox,sandbox/envd}
- Add proto specs (process, filesystem) with buf-based code generation
- Implement full envd: process exec, filesystem ops, port forwarding,
  cgroup management, MMDS integration, and HTTP API
- Update main module dependencies (firecracker SDK, pgx, goose, etc.)
- Remove placeholder .gitkeep files replaced by real implementations

envd/internal/api/auth_test.go

@@ -0,0 +1,62 @@
+package api
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"git.omukk.dev/wrenn/sandbox/envd/internal/shared/keys"
+)
+
+func TestKeyGenerationAlgorithmIsStable(t *testing.T) {
+	t.Parallel()
+	apiToken := "secret-access-token"
+	secureToken := &SecureToken{}
+	err := secureToken.Set([]byte(apiToken))
+	require.NoError(t, err)
+	api := &API{accessToken: secureToken}
+
+	path := "/path/to/demo.txt"
+	username := "root"
+	operation := "write"
+	timestamp := time.Now().Unix()
+
+	signature, err := api.generateSignature(path, username, operation, &timestamp)
+	require.NoError(t, err)
+	assert.NotEmpty(t, signature)
+
+	// locally generated signature
+	hasher := keys.NewSHA256Hashing()
+	localSignatureTmp := fmt.Sprintf("%s:%s:%s:%s:%s", path, operation, username, apiToken, strconv.FormatInt(timestamp, 10))
+	localSignature := fmt.Sprintf("v1_%s", hasher.HashWithoutPrefix([]byte(localSignatureTmp)))
+
+	assert.Equal(t, localSignature, signature)
+}
+
+func TestKeyGenerationAlgorithmWithoutExpirationIsStable(t *testing.T) {
+	t.Parallel()
+	apiToken := "secret-access-token"
+	secureToken := &SecureToken{}
+	err := secureToken.Set([]byte(apiToken))
+	require.NoError(t, err)
+	api := &API{accessToken: secureToken}
+
+	path := "/path/to/resource.txt"
+	username := "user"
+	operation := "read"
+
+	signature, err := api.generateSignature(path, username, operation, nil)
+	require.NoError(t, err)
+	assert.NotEmpty(t, signature)
+
+	// locally generated signature
+	hasher := keys.NewSHA256Hashing()
+	localSignatureTmp := fmt.Sprintf("%s:%s:%s:%s", path, operation, username, apiToken)
+	localSignature := fmt.Sprintf("v1_%s", hasher.HashWithoutPrefix([]byte(localSignatureTmp)))
+
+	assert.Equal(t, localSignature, signature)
+}