feat(sandbox): replace one-shot docker run with session-scoped containers

[lyingbug]

Summary

• Rework the Docker sandbox backend from one-shot docker run --rm into a RemoteSandboxClient: one long-lived container per session, so shell_exec, attachments, and artifact collection match Cube/E2B.
• Exec wraps the process with timeout(1) so client cancel actually kills in-container work; files go through the Engine archive API; idle containers are reaped from an activity-marker mtime.
• Settings grow daemon host / TLS / CPU / memory / PID / network / idle TTL fields. An empty host follows the local Docker CLI (DOCKER_HOST, then the current docker context) so Colima and Docker Desktop work without pasting a socket path. Remote tcp:// daemons require TLS; host / container: network modes are rejected.
• Standard image now includes curl (egress check) and creates containers with root PID 1 so the activity marker is writable under USER user. Image pulls are no longer killed by the 30s HTTP client timeout.

Test plan

• Settings → add a Docker backend, leave daemon address empty, run the connection check on a host where docker ps works (Linux socket, Colima, or Docker Desktop)
• Rebuild wechatopenai/weknora-sandbox:latest from docker/Dockerfile.sandbox and confirm deep check (including egress) passes
• Start a session, shell_exec twice, confirm packages/files survive; wait past idle TTL and confirm the container is reclaimed
• Cancel a long-running exec and confirm the in-container process is gone
• Saving a tcp:// host without a TLS cert directory is rejected; network_mode=host is rejected
• go test ./internal/sandbox/ ./internal/handler/
• Optional: go test -tags=docker_integration ./internal/sandbox/ against a reachable daemon