[Fazorath]

Closes #119

What

• The Sandbox app (app=True) serves POST /api/sandbox/stop; /api/state's sandbox.can_stop tells the Panel to show Stop Sandbox. Outside the app the route doesn't exist and can_stop is false.
• The route refuses a non-loopback client, a Host that isn't a loopback name (DNS rebinding), and an Origin that isn't the page's own. A request with no Origin is allowed: browsers always send one on a cross-site POST, so only a local non-browser process can omit it.
• After Stop the dashboard shows "It is safe to close this tab."
• The app ends itself after 10 minutes with no /api/state request (Sandbox clock; tests use a fake clock and a short limit). Both paths set the server to exit, so the with removes the temp folder.

Tested

scripts/check.sh passes. Real serve() runs end on Stop and on idle with the folder gone. Not tested: a real Windows/macOS double-click (no app bundle in this slice).

Security review

Requested: a route that ends the process.