feat(proxy): publicPorts — per-port public preview for sandboxes

[Wilbert957]

Summary

Sandboxes today are forced public: true (0G doesn't use Daytona OIDC), so every user port is world-reachable. This adds an optional "publicPorts": [8080, 3000] field on create: only listed ports are publicly reachable; all other ports fall back to Daytona's private-sandbox auth path (owner preview tokens still work — the restriction targets the public, not the owner). Omitting the field keeps today's all-ports-public behavior; existing sandboxes are untouched.

Enforcement lives in the 0g-daytona fork (0gfoundation/0g-daytona@0g/main, baseline v0.189.0, images daytona-{api,proxy}:v0.189.0-0g.1 on GCP AR):

• api: sandbox.publicPorts jsonb column + migration, DTO validation, normalize (dedupe/sort/reject reserved 22222/2280/33333/reject empty/cap 16), proxy-only GET /preview/:id/public-ports
• proxy: the public-skip gate in GetProxyTarget now consults the allowlist (hand-written API call, no api-client-go regen; 4xx degrades to unrestricted so the patched proxy works against a stock API; cached 1h — the field is immutable after create)

This PR (billing-proxy side):

• boundary validation with clear 400s, incl. the sealed rule Daytona doesn't know: sealed + publicPorts must include 8080 (agent-fronting port)
• round-trip check: a stock Daytona API silently strips unknown DTO fields — the user would get an unrestricted sandbox while believing ports are locked. If the create response carries no publicPorts, the billing proxy fails the create with 502 and stops the orphan
• create responses gain preview_urls: {"8080": "http://8080-<id>.<PROXY_DOMAIN>"}
• cmd/user create --ports 8080,3000
• compose: DAYTONA_API_IMAGE/DAYTONA_PROXY_IMAGE params (official images default); also folds in BROKER_IMAGE + RUNNER_RUNTIME parameterization (note: runner runtime default flips sysbox-runc → runc; kernel ≥5.12 hosts must set RUNNER_RUNTIME=sysbox-runc to keep feat(daytona): upgrade to v0.189 + Sysbox host-boundary isolation #51's host-boundary isolation)

Test plan

• fork proxy unit tests: allowlist gate (in-list pass / out-of-list auth / 404-degrade / cache single-fetch) — 4/4
• internal/proxy unit tests: 15 validation cases + decorate supported/unsupported/no-domain — all pass
• go build ./... && go test ./... green in both repos
• E2E on local stack with fork images: publicPorts:[8080] sandbox with dual listeners — 8080 serves, 9090 blocked; unrestricted + sealed sandboxes unchanged (pending stack restart approval)

🤖 Generated with Claude Code

[Wilbert957]

E2E verified on wei-tapp (136.113.168.149, fork images v0.189.0-0g.1):

• create with --ports 8080 → response echoes publicPorts: [8080] (fork API persists the field)
• sandbox running listeners on 8080 + 9090:
  • http://8080-<id>.…nip.io:4000/ → 200, content served
  • http://9090-<id>.…nip.io:4000/ → 307 → dex auth (private-port path; public callers blocked)
• regression: sandbox created without publicPorts → 9090 → 200 (all-ports-public behavior unchanged)
• test sandboxes deleted

Note: the wei-tapp billing container is an older build, so preview_urls enrichment and the stock-backend 502 guard weren't exercised there (unit-tested in this PR); core enforcement is entirely Daytona-side and confirmed live. GCP firewall needed tcp:4000 opened (was 8080-8082 only) — done manually.