Add minimal control plane with REST API, database, and reconciler

- REST API (chi router): sandbox CRUD, exec, pause/resume, file write/read
- PostgreSQL persistence via pgx/v5 + sqlc (sandboxes table with goose migration)
- Connect RPC client to host agent for all VM operations
- Reconciler syncs host agent state with DB every 30s (detects TTL-reaped sandboxes)
- OpenAPI 3.1 spec served at /openapi.yaml, Swagger UI at /docs
- Added WriteFile/ReadFile RPCs to hostagent proto and implementations
- File upload via multipart form, download via JSON body POST
- sandbox_id propagated from control plane to host agent on create

internal/config/config.go

@@ -0,0 +1,36 @@
+package config
+
+import (
+	"os"
+	"strings"
+)
+
+// Config holds the control plane configuration.
+type Config struct {
+	DatabaseURL   string
+	ListenAddr    string
+	HostAgentAddr string
+}
+
+// Load reads configuration from environment variables.
+func Load() Config {
+	cfg := Config{
+		DatabaseURL:   envOrDefault("DATABASE_URL", "postgres://wrenn:wrenn@localhost:5432/wrenn?sslmode=disable"),
+		ListenAddr:    envOrDefault("CP_LISTEN_ADDR", ":8080"),
+		HostAgentAddr: envOrDefault("CP_HOST_AGENT_ADDR", "http://localhost:50051"),
+	}
+
+	// Ensure the host agent address has a scheme.
+	if !strings.HasPrefix(cfg.HostAgentAddr, "http://") && !strings.HasPrefix(cfg.HostAgentAddr, "https://") {
+		cfg.HostAgentAddr = "http://" + cfg.HostAgentAddr
+	}
+
+	return cfg
+}
+
+func envOrDefault(key, def string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return def
+}