feat(web,api): add WebUI sandbox terminal

[Sam-Hui-dot]

Related to #643

Summary

This PR implements WebUI terminal login for running CubeSandbox instances.

• Adds ticket-based terminal WebSocket endpoints in CubeAPI to avoid exposing normal auth credentials in the WebSocket URL.
• Bridges browser terminal I/O to envd PTY process APIs with input, output, resize, reconnect, idle cleanup, and disconnect cleanup.
• Adds running-container metadata to sandbox list/detail responses and exposes container selection when multiple running containers are available.
• Adds terminal audit events for ticket issue, open failure, session open, and session close.
• Adds WebUI terminal entry points on sandbox list/detail pages with xterm.js, paste handling, draggable/resizable floating dialog, maximize/restore, hide/restore, and reconnect support.
• Updates OpenAPI schema, generated WebUI types, mock fixtures, i18n strings, and WebUI documentation.

Validation

• git diff --check
• npm --prefix web run build
• docker run --rm -v /home/sam/CubeSandbox-web-terminal-643/CubeAPI:/app -w /app rust:1.85-bookworm sh -lc '/usr/local/cargo/bin/cargo test --locked terminal'
  • 20 related tests passed
• docker run --rm -v /home/sam/CubeSandbox-web-terminal-643/CubeAPI:/app -w /app rust:1.85-bookworm sh -lc '/usr/local/cargo/bin/cargo fmt -- --check'
• cd CubeAPI && docker build -f Dockerfile -t cubesandbox-cube-api:rhino-643 .
• Manual local one-click deployment:
  • opened WebUI terminal for a real running sandbox
  • verified command execution
  • verified paste and multi-line paste behavior
  • verified resize, maximize/restore, hide/restore, and reconnect
  • verified terminal audit logs

Notes

• Reconnect intentionally starts a fresh terminal session.
• Screenshots from local manual validation are available in the PR discussion.

[Sam-Hui-dot]