Finish SAND-WP-0002: remote smoke, podman-compose, HTTP stub

- T10 smoke passed on CoulombCore (sand-boxer self-deploy, sandbox 4e542c51)
- Add e2e smoke compose, scripts/smoke-compose-e2e.sh, make smoke-remote
- Support SANDBOXER_COMPOSE_CMD for podman-compose hosts
- FastAPI v0 stub at sandboxer.api.app; migration gaps doc
- Mark workplan finished (all 10 tasks done)

tests/test_api.py

@@ -0,0 +1,49 @@
+"""HTTP API v0 stub tests."""
+
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+from sandboxer.api.app import app
+from sandboxer.models import ActorType, Consumer, SandboxState, SandboxStatus
+
+
+def test_list_sandboxes_empty() -> None:
+    with patch("sandboxer.api.app._manager") as mgr:
+        mgr.list.return_value = []
+        client = TestClient(app)
+        assert client.get("/v1/sandboxes").json() == []
+
+
+def test_get_sandbox_not_found() -> None:
+    with patch("sandboxer.api.app._manager") as mgr:
+        mgr.get.return_value = None
+        client = TestClient(app)
+        assert client.get("/v1/sandboxes/missing").status_code == 404
+
+
+def test_create_sandbox() -> None:
+    from datetime import UTC, datetime
+
+    status = SandboxStatus(
+        sandbox_id="abc12345",
+        profile_id="profile.compose-e2e",
+        extension_id="ext.compose-ssh",
+        state=SandboxState.READY,
+        consumer=Consumer(actor=ActorType.ADM, project="sand-boxer"),
+        created_at=datetime.now(UTC),
+        updated_at=datetime.now(UTC),
+    )
+    with patch("sandboxer.api.app._manager") as mgr:
+        mgr.create.return_value = status
+        client = TestClient(app)
+        resp = client.post(
+            "/v1/sandboxes",
+            json={
+                "profile": "profile.compose-e2e",
+                "inputs": {"repo": "/tmp/x"},
+                "consumer": {"actor": "adm", "project": "sand-boxer"},
+            },
+        )
+        assert resp.status_code == 200
+        assert resp.json()["sandbox_id"] == "abc12345"