feat: cloud adapters E2B/Modal and billing export (SAND-WP-0010)

Add credentialed E2B and Modal extensions, burst routing fallback,
fin-hub meter export hook, BYOK docs, and 77 tests.

docs/routing.md

@@ -10,6 +10,8 @@ route:
   strategy: prefer-self-hosted
   extensions:
     - ext.compose-ssh
+    - ext.e2b
+    - ext.modal
     - ext.saas-stub
   max_cost_per_hour_usd: 1.0
 ```
@@ -19,7 +21,7 @@ route:
 | Strategy | Behavior |
 |----------|----------|
 | `explicit` | Use `profile.extension` (default when no route) |
-| `prefer-self-hosted` | First self-hosted candidate with resolvable host; else SaaS |
+| `prefer-self-hosted` | Self-hosted if host available; else credentialed E2B/Modal; else stub |
 | `lowest-cost` | Self-hosted if available; else cheapest `estimate_cost` |
 | `lowest-latency` | Self-hosted if available; else last candidate (v0) |
 
@@ -38,7 +40,12 @@ sandboxer create --profile profile.saas-stub
 
 | Profile | Route |
 |---------|-------|
-| `profile.burst-sandbox` | compose-ssh → saas-stub fallback |
+| `profile.burst-sandbox` | compose-ssh → e2b → modal → saas-stub |
+| `profile.e2b-burst` | explicit `ext.e2b` |
+| `profile.modal-gpu` | explicit `ext.modal` |
 | `profile.saas-stub` | explicit `ext.saas-stub` |
 
+Cloud adapters require provider credentials (`E2B_API_KEY`, `MODAL_TOKEN_ID`).
+See `docs/cloud-adapters.md`.
+
 Resolver: `sandboxer.routing.resolver.resolve_extension`.