fix(boxes): Test Connection on existing-box edit form (#72) (#126)

The Test Connection button on the box edit screen was failing on
existing boxes because the JS sent a non-existent `server_id` form
field. The backend already supports a "look up by box_id, decrypt
stored key" recovery path (haproxy_config.go:427-449) but never
received the box_id needed to trigger it.

Form field name `server_id` -> `box_id` to match the readonly input
the edit form already renders, and the existing backend path takes
over from there. No changes needed on the backend; this is purely
the missing handshake the recovery code was waiting for.

Phase 0 of the issue-72 plan; landed independently so the visible
bug clears now and the multi-key rotation work that follows starts
from a working Test Connection baseline.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: sarg3nt

gearbox/internal/framework/templates/pages/haproxy_settings.templ

@@ -708,9 +708,12 @@ templ haProxyBoxForm(user *models.User, server *database.BoxDB, isEdit bool, err
 			spinner.classList.remove('hidden');
 			resultDiv.classList.add('hidden');
 
-			// Build form data for Gearbox Agent API connection test
+			// Build form data for Gearbox Agent API connection test.
+			// On edit the api_key field is empty (we never surface the stored
+			// secret to the browser); box_id lets the backend look up and
+			// decrypt the stored key server-side. See haproxy_config.go.
 			const formData = new URLSearchParams();
-			formData.append('server_id', document.getElementById('server_id')?.value || '');
+			formData.append('box_id', document.getElementById('box_id')?.value || '');
 			formData.append('agent_url', document.getElementById('agent_url')?.value || '');
 			formData.append('api_key', document.getElementById('api_key')?.value || '');