Finish SAND-WP-0002: remote smoke, podman-compose, HTTP stub

- T10 smoke passed on CoulombCore (sand-boxer self-deploy, sandbox 4e542c51)
- Add e2e smoke compose, scripts/smoke-compose-e2e.sh, make smoke-remote
- Support SANDBOXER_COMPOSE_CMD for podman-compose hosts
- FastAPI v0 stub at sandboxer.api.app; migration gaps doc
- Mark workplan finished (all 10 tasks done)

scripts/smoke-compose-e2e.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Remote smoke test for profile.compose-e2e (SAND-WP-0002-T10).
+set -euo pipefail
+
+HOST="${SANDBOXER_HOST:-coulombcore}"
+REPO="${SMOKE_REPO:-$(cd "$(dirname "$0")/.." && pwd)}"
+SSH_DEST="${SANDBOXER_SSH_USER:+${SANDBOXER_SSH_USER}@}${HOST}"
+export SANDBOXER_COMPOSE_CMD="${SANDBOXER_COMPOSE_CMD:-podman-compose}"
+
+echo "==> host=${HOST} repo=${REPO}"
+
+echo "==> create"
+CREATE_JSON=$(sandboxer create \
+  --profile profile.compose-e2e \
+  --input "repo=${REPO}" \
+  --host "${HOST}" \
+  --project sand-boxer \
+  --actor adm)
+echo "${CREATE_JSON}"
+
+SANDBOX_ID=$(echo "${CREATE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['sandbox_id'])")
+STATE=$(echo "${CREATE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['state'])")
+REMOTE_DIR=$(echo "${CREATE_JSON}" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('reachability',{}).get('remote_dir',''))")
+COMPOSE_PROJECT=$(echo "${CREATE_JSON}" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('reachability',{}).get('compose_project',''))")
+
+if [[ "${STATE}" != "ready" ]]; then
+  echo "FAIL: expected state=ready got ${STATE}" >&2
+  exit 1
+fi
+
+echo "==> compose ps (remote)"
+ssh -o BatchMode=yes "${SSH_DEST:-${HOST}}" \
+  "${SANDBOXER_COMPOSE_CMD} -p ${COMPOSE_PROJECT} -f ${REMOTE_DIR}/e2e/docker-compose.smoke.yml ps"
+
+echo "==> destroy ${SANDBOX_ID}"
+sandboxer destroy "${SANDBOX_ID}"
+
+echo "==> verify cleanup"
+LEFT=$(ssh -o BatchMode=yes "${SSH_DEST:-${HOST}}" \
+  "test -d ${REMOTE_DIR} && echo yes || echo no")
+if [[ "${LEFT}" == "yes" ]]; then
+  echo "FAIL: remote dir still exists: ${REMOTE_DIR}" >&2
+  exit 1
+fi
+
+COMPOSE_LEFT=$(ssh -o BatchMode=yes "${SSH_DEST:-${HOST}}" \
+  "podman ps -a --filter label=io.podman.compose.project=${COMPOSE_PROJECT} --format '{{.Names}}'" 2>/dev/null || true)
+
+if [[ -n "${COMPOSE_LEFT}" ]]; then
+  echo "WARN: compose projects still listed: ${COMPOSE_LEFT}" >&2
+fi
+
+echo "==> PASS sandbox_id=${SANDBOX_ID}"