feat: TTL enforcement and operational hardening (SAND-WP-0009)

Add TTL parser, expires_at on create, extend_ttl and expire/reap APIs,
activity-core integration doc, repo classification, registry refresh,
HTTP parity, and 69 tests.

src/sandboxer/api/app.py

@@ -6,6 +6,8 @@ from fastapi import FastAPI, HTTPException
 
 from sandboxer.core.manager import SandboxManager
 from sandboxer.models import (
+    ExpireActionResult,
+    ExtendTtlRequest,
     SandboxCreateRequest,
     SandboxStatus,
     SnapshotRecord,
@@ -82,4 +84,29 @@ def get_snapshot(snapshot_id: str) -> SnapshotRecord:
     record = _manager.get_snapshot(snapshot_id)
     if not record:
         raise HTTPException(status_code=404, detail="snapshot not found")
-    return record
+    return record
+
+
+@app.post("/v1/sandboxes/{sandbox_id}/recreate", response_model=SandboxStatus)
+def recreate_sandbox(sandbox_id: str) -> SandboxStatus:
+    try:
+        return _manager.recreate(sandbox_id)
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail=str(exc)) from exc
+    except Exception as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@app.patch("/v1/sandboxes/{sandbox_id}/ttl", response_model=SandboxStatus)
+def extend_sandbox_ttl(sandbox_id: str, request: ExtendTtlRequest) -> SandboxStatus:
+    try:
+        return _manager.extend_ttl(sandbox_id, request.duration)
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail=str(exc)) from exc
+    except (RuntimeError, ValueError) as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+
+@app.post("/v1/sandboxes/expire", response_model=list[ExpireActionResult])
+def expire_sandboxes(apply: bool = False) -> list[ExpireActionResult]:
+    return _manager.expire(apply=apply)