feat: Sprint 1 remainder — Postgres store, Docker client, warm pool, sessions route

- PostgresUserStore (Queryable) + migration + env-gated wiring
- DockerodeClient behind injected DockerEngine
- ImageManager, WarmPool, Dockerfile.wordpress, docker-compose
- POST /sessions spins up sandbox (503 when unconfigured)
- ADRs 0014-0015; 68 unit tests green

api/__tests__/sandbox/image-manager.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { ImageManager } from '../../src/sandbox/image-manager.ts';
+
+describe('ImageManager', () => {
+  const manager = new ImageManager({ baseImage: 'wursor-base:latest', webPort: 8080 });
+
+  it('returns the pre-baked image ref', () => {
+    expect(manager.imageRef()).toBe('wursor-base:latest');
+  });
+
+  it('produces a container spec with the web port and management label', () => {
+    expect(manager.containerSpec('wursor-abc')).toEqual({
+      image: 'wursor-base:latest',
+      name: 'wursor-abc',
+      ports: [{ container: 80, host: 8080 }],
+      labels: { 'wursor.managed': 'true' },
+    });
+  });
+});