feat: TTL enforcement and operational hardening (SAND-WP-0009)

Add TTL parser, expires_at on create, extend_ttl and expire/reap APIs,
activity-core integration doc, repo classification, registry refresh,
HTTP parity, and 69 tests.

src/sandboxer/models.py

@@ -164,6 +164,8 @@ class SandboxStatus(BaseModel):
     host: str | None = None
     reachability: Reachability | None = None
     inputs: dict[str, str] = Field(default_factory=dict)
+    ttl: str | None = None
+    expires_at: datetime | None = None
     error: str | None = None
     meter: MeterRecord | None = None
     telemetry: dict | None = None  # IntrospectionReport JSON when canary
@@ -173,6 +175,17 @@ class SandboxStatus(BaseModel):
     destroyed_at: datetime | None = None
 
 
+class ExtendTtlRequest(BaseModel):
+    duration: str
+
+
+class ExpireActionResult(BaseModel):
+    sandbox_id: str
+    reason: Literal["ttl", "idle"]
+    action: Literal["dry-run", "expired", "destroyed", "failed"]
+    error: str | None = None
+
+
 class SnapshotRestoreRequest(BaseModel):
     host: str | None = None
     consumer: Consumer | None = None