Finish SAND-WP-0002: remote smoke, podman-compose, HTTP stub

- T10 smoke passed on CoulombCore (sand-boxer self-deploy, sandbox 4e542c51)
- Add e2e smoke compose, scripts/smoke-compose-e2e.sh, make smoke-remote
- Support SANDBOXER_COMPOSE_CMD for podman-compose hosts
- FastAPI v0 stub at sandboxer.api.app; migration gaps doc
- Mark workplan finished (all 10 tasks done)

src/sandboxer/api/app.py

@@ -0,0 +1,40 @@
+"""HTTP API v0 stub — CLI remains primary; run via uvicorn sandboxer.api.app:app."""
+
+from __future__ import annotations
+
+from fastapi import FastAPI, HTTPException
+
+from sandboxer.core.manager import SandboxManager
+from sandboxer.models import SandboxCreateRequest, SandboxStatus
+
+app = FastAPI(title="sand-boxer", version="0.0.0")
+_manager = SandboxManager()
+
+
+@app.post("/v1/sandboxes", response_model=SandboxStatus)
+def create_sandbox(request: SandboxCreateRequest, host: str | None = None) -> SandboxStatus:
+    try:
+        return _manager.create(request, host=host)
+    except Exception as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@app.get("/v1/sandboxes/{sandbox_id}", response_model=SandboxStatus)
+def get_sandbox(sandbox_id: str) -> SandboxStatus:
+    status = _manager.get(sandbox_id)
+    if not status:
+        raise HTTPException(status_code=404, detail="sandbox not found")
+    return status
+
+
+@app.get("/v1/sandboxes", response_model=list[SandboxStatus])
+def list_sandboxes() -> list[SandboxStatus]:
+    return _manager.list()
+
+
+@app.delete("/v1/sandboxes/{sandbox_id}", response_model=SandboxStatus)
+def destroy_sandbox(sandbox_id: str) -> SandboxStatus:
+    try:
+        return _manager.destroy(sandbox_id)
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail=str(exc)) from exc