Add the docker-sbx provider

[czpython]

Closes #8.

Summary

This change adds the docker-sbx VM provider. The provider runs each host as a Docker Sandboxes microVM. Each microVM has its own kernel, its own filesystem, and its own Docker daemon. This gives more isolation than the local docker provider.

Changes

• src/providers/docker_sbx/ contains the provider. The SbxCLI class starts the sbx command as an async subprocess. The settings use the DOCKER_SBX_ prefix.
• images/sbx/ contains the sandbox template. The template starts sshd and does not need environment variables. The sbx create command cannot send environment variables.
• The provider injects the SSH key and the caller environment with sbx exec. The script goes through stdin. Secrets do not go on the command line.
• The provider publishes port 22 on the DOCKER_SBX_ADVERTISE_HOST address. The daemon selects a free host port.
• The provider always sets --cpus and --memory. Without these flags, the daemon gives one sandbox all host CPUs and half of the host memory.
• The provider sets supports_tailnet to False. The service does not send a Tailscale setup script to this provider.
• docs/deploy.md shows the host prerequisites and the container configuration. The host owns the sbx installation, the login, and the daemon. A drukbox container connects through a socket mount and the DOCKER_SANDBOXES_API variable.

Review

An adversarial review found 10 problems. This PR fixes all of them:

• The provider did not set supports_tailnet to False. A tailnet-mode service made a Tailscale key for each host and then lost it.
• The template entrypoint made the authorized_keys file empty at each start. A restart of a sandbox removed the SSH key.
• The error check matched all messages that contain "not found". A login error could delete the record and the workspace of a live sandbox.
• A workspace mkdir error went around the provider error boundary. The host record stopped in a state that blocks deletion.
• A failed create did not remove a partially created sandbox.
• An IPv6 address made an incorrect port specification. Brackets are necessary for IPv6.
• The bootstrap script wrote the key only for the root user. The ssh_username setting had no effect.
• The sbx calls had no time limit. A blocked daemon stopped requests permanently. The limit is now 600 seconds.
• The workspace removal blocked the event loop. The removal now runs in a thread.
• docs/networking.md did not show the new provider.

Verification

• uv run ruff check: pass
• uv run ruff format --check: pass
• uv run pyright: 0 errors
• uv run pytest: 377 tests pass

Known limits

• The conformance suite (api-tests) did not run against a live deployment.
• The image ghcr.io/czpython/drukbox/sbx-sandbox:latest does not exist yet. Build and push the image before deployment.
• Sandboxes have no SERVICE_LABEL tag. The sbx CLI has no label option. Give each deployment its own daemon.