Implement SandboxPreviewProxy plug (HTTP + WebSocket)

[BlueHotDog]

Part of #830 — Phase 1 execution, Day 12.

Depends on #833 (WebSocket proxy spike) and #838 (Sandbox context).

Tasks

• SandboxPreviewProxy plug: parse Host header → look up VM IP + port from sandboxes table → proxy
• HTTP: stream response back to client
• WebSocket: hand off to WebSock upgrade path
• Add wildcard subdomain dispatch to Router and Endpoint
• Wildcard TLS cert via Let's Encrypt DNS-01 / Cloudflare
• Tests: proxy routes to correct VM, 404 for unknown sandbox_id

Done when

Browser can load {sandbox_id}.preview.frontman.sh and Vite HMR works through the proxy.