Add authentication, authorization, and team-scoped access control

Implement email/password auth with JWT sessions and API key auth for
sandbox lifecycle. Users get a default team on signup; sandboxes,
snapshots, and API keys are scoped to teams.

- Add user, team, users_teams, and team_api_keys tables (goose migrations)
- Add JWT middleware (Bearer token) for user management endpoints
- Add API key middleware (X-API-Key header, SHA-256 hashed) for sandbox ops
- Add signup/login handlers with transactional user+team creation
- Add API key CRUD endpoints (create/list/delete)
- Replace owner_id with team_id on sandboxes and templates
- Update all handlers to use team-scoped queries
- Add godotenv for .env file loading
- Update OpenAPI spec and test UI with auth flows

internal/db/teams.sql.go

@@ -0,0 +1,75 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.30.0
+// source: teams.sql
+
+package db
+
+import (
+	"context"
+)
+
+const getDefaultTeamForUser = `-- name: GetDefaultTeamForUser :one
+SELECT t.id, t.name, t.created_at FROM teams t
+JOIN users_teams ut ON ut.team_id = t.id
+WHERE ut.user_id = $1 AND ut.is_default = TRUE
+LIMIT 1
+`
+
+func (q *Queries) GetDefaultTeamForUser(ctx context.Context, userID string) (Team, error) {
+	row := q.db.QueryRow(ctx, getDefaultTeamForUser, userID)
+	var i Team
+	err := row.Scan(&i.ID, &i.Name, &i.CreatedAt)
+	return i, err
+}
+
+const getTeam = `-- name: GetTeam :one
+SELECT id, name, created_at FROM teams WHERE id = $1
+`
+
+func (q *Queries) GetTeam(ctx context.Context, id string) (Team, error) {
+	row := q.db.QueryRow(ctx, getTeam, id)
+	var i Team
+	err := row.Scan(&i.ID, &i.Name, &i.CreatedAt)
+	return i, err
+}
+
+const insertTeam = `-- name: InsertTeam :one
+INSERT INTO teams (id, name)
+VALUES ($1, $2)
+RETURNING id, name, created_at
+`
+
+type InsertTeamParams struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+func (q *Queries) InsertTeam(ctx context.Context, arg InsertTeamParams) (Team, error) {
+	row := q.db.QueryRow(ctx, insertTeam, arg.ID, arg.Name)
+	var i Team
+	err := row.Scan(&i.ID, &i.Name, &i.CreatedAt)
+	return i, err
+}
+
+const insertTeamMember = `-- name: InsertTeamMember :exec
+INSERT INTO users_teams (user_id, team_id, is_default, role)
+VALUES ($1, $2, $3, $4)
+`
+
+type InsertTeamMemberParams struct {
+	UserID    string `json:"user_id"`
+	TeamID    string `json:"team_id"`
+	IsDefault bool   `json:"is_default"`
+	Role      string `json:"role"`
+}
+
+func (q *Queries) InsertTeamMember(ctx context.Context, arg InsertTeamMemberParams) error {
+	_, err := q.db.Exec(ctx, insertTeamMember,
+		arg.UserID,
+		arg.TeamID,
+		arg.IsDefault,
+		arg.Role,
+	)
+	return err
+}