add sandbox TTL support

[codealisha99]

Summary

• Adds optional TTL on sandboxes (--ttl, --warn-before flags) with ExpiresAt/WarnAt fields persisted in sandbox state
• Introduces a background watcher that polls sandboxes and emits expiration_warning, expired, and agent_completed events (deduplicated, single goroutine)
• Surfaces events two ways: amika sandbox watch CLI command (stderr) and GET /v1/events SSE endpoint on amika-server

Closes #158.

Changes

• internal/watcher/ — polling loop with injectable Clock and StateChecker for testability
• internal/sandbox/ttl.go — shared ComputeTTL used by both CLI and service layer
• internal/sandbox/docker.go — GetDockerContainerExitCode helper for agent-completion detection
• internal/httpapi/server.go — EventBroker pub/sub + SSE handler
• cmd/amika/watch.go — new sandbox watch [--sandbox <name>] command
• cmd/amika-server/main.go — boots watcher + broker, wires SSE handler
• pkg/amika, internal/apiclient — TTL fields on request/response types

Backward compatibility

Sandbox state schema uses omitempty on new fields — existing sandboxes load without migration and emit no events.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.