feat: Sprint 1 — Playwright e2e + sandbox orchestration (TDD)

- e2e: Playwright chat-flow (sign up -> chat) with api/web webServer harness
- api: sandbox services subset/media-proxy/manifest/gc + DockerClient contract
- api: SandboxManager orchestrator (fake-Docker tested); /health route
- 53 unit tests green; Playwright e2e green

api/__tests__/sandbox/gc.test.ts

@@ -0,0 +1,29 @@
+import { describe, it, expect } from 'vitest';
+import { decideGc } from '../../src/sandbox/gc.ts';
+
+const opts = { idleMs: 15 * 60 * 1000, hardMs: 24 * 60 * 60 * 1000 };
+const now = 1_000_000;
+
+describe('decideGc', () => {
+  it('pauses a running sandbox after the idle threshold', () => {
+    expect(decideGc({ status: 'running', lastActiveAt: now - opts.idleMs - 1, createdAt: 0 }, now, opts)).toBe('pause');
+  });
+
+  it('keeps an active running sandbox', () => {
+    expect(decideGc({ status: 'running', lastActiveAt: now - 1000, createdAt: 0 }, now, opts)).toBe('keep');
+  });
+
+  it('destroys any sandbox past the hard timeout regardless of activity', () => {
+    expect(decideGc({ status: 'running', lastActiveAt: now - 1000, createdAt: now - opts.hardMs - 1 }, now, opts)).toBe(
+      'destroy',
+    );
+  });
+
+  it('does not re-pause an already paused sandbox', () => {
+    expect(decideGc({ status: 'paused', lastActiveAt: now - opts.idleMs - 1, createdAt: 0 }, now, opts)).toBe('keep');
+  });
+
+  it('keeps a destroyed sandbox', () => {
+    expect(decideGc({ status: 'destroyed', lastActiveAt: 0, createdAt: 0 }, now, opts)).toBe('keep');
+  });
+});