feat: add private sandbox preview tab

[laotoutou]

Summary

• add an independent Preview Inspector tab for Sandbox loopback applications
• turn explicit and bare localhost, 127.0.0.1, and IPv6 loopback URLs in conversations and terminal output into Preview actions
• expose authenticated Environment preview create, renew, and revoke routes through the official Sandbox0 SDK only
• keep iframe grants short-lived, renew active previews, revoke them on close or replacement, and isolate separately opened tabs from their opener
• publish the Environment API contract and cover URL parsing, authorization routing, SDK compatibility, and UI presentation

Dependencies

• backend capability: feat: add private sandbox previews sandbox0#813
• SDK capability: feat: add sandbox preview lifecycle sdk-js#75
• before this PR is marked ready, sdk-js must be released and Sandpi's dependency and lockfile must be bumped to that release; the compatibility guard currently returns a clear 503 with older SDKs instead of falling back to handwritten HTTP

Validation

• npm run openapi:check
• npm run typecheck
• npm run lint
• npm test (725 tests, including PostgreSQL integration)
• npm run build
• the Sandbox0 gateway/procd chain used by this UI was validated on the disposable remote environment documented in sandbox0 PR 813