Allow sandbox lookup by id, uri, or name
CLI expose/unexpose now call the API client instead of printing
success directly. Expose accepts an optional description; both
commands send auth via POCKETENV_TOKEN or a fetched token and
handle errors with proper logging and exit.