Add sandbox secret/env types and control APIs
- Add Secret and EnvVar lexicon/pkl defs and generated TS types; switch
secrets/envs arrays to ref items
- Rename sandbox route params from uri to id across lexicons and
handlers
- Implement create/start/stop/delete handlers to call external sandbox
API via axios; add axios dependency and SANDBOX_API_URL default
- Add claimSandbox endpoint and web client/hooks; small UI updates
(Navbar)