…lient, fix dead env vars + stale refs

- regenerate toolbox-api-client from the (already-renamed) committed
  daemon swagger: 7.12.0 → pinned 7.23.0 generator, kills the last
  4 generated "sandbox entrypoint" doc-comments; missed by #716/#718
  which covered only the product clients
- add toolbox-api-client to the api-client-drift gate with
  --excludeTaskDependencies (committed daemon swagger is the contract;
  daemon-source↔swagger drift stays ungated, needs swag toolchain)
- fix nx paths broken since the apps/ workspace flattening: generator
  -i specs in toolbox/runner client project.json (apps/daemon→daemon,
  apps/runner→runner — toolbox regen failed outright on the stale
  path) and nx.json cache inputs (go.work, daemon swagger), which
  pointed at nonexistent files and never invalidated caches
- e2e bootstrap.sh + infra-local api.env wrote ADMIN_MAX_*_PER_SANDBOX
  but the API reads ADMIN_MAX_*_PER_BOX (configuration.ts:292) with
  default 0 — admin-org per-box quotas were silently unset
- stack-reset.sh and infra-local README TRUNCATE/SELECT table
  `sandbox`, which migration 1781016743403 renamed to `box`; also
  /api/sandbox routes → /api/box and {{sandboxId}} → {{boxId}} per
  the configuration DTO example
- sweep remaining sandbox vocabulary from e2e cases, teardown,
  runner-update-binary.sh, and infra-local docs (comments,
  docstrings, test function names; no selector references them)
- includes 3 files prettier-normalized by the repo's `make lint:fix`
  pre-commit autofixer (eslint.config.mjs, Sidebar.tsx,
  Onboarding.tsx) — out of format on main; the hook is repo-wide
  and re-applies them on every commit until committed

Part of #711.

Signed-off-by: dorianzheng <xingzhengde72@gmail.com>

…lient, fix dead env vars + stale refs (#723)

Part of #711 — closes out the "Part 1 of N" remainder. A repo-wide sweep
found the rename effectively complete in source
(`runner`/`cli`/`daemon`/`dashboard`/`proxy` at zero tokens; `apps/api`
leftovers are historical migrations, correct as-is). What remained is
below.

## Generated client (the bulk of the diff)

**`toolbox-api-client` regenerated** from the committed
`apps/daemon/pkg/toolbox/docs/swagger.json` (which #718 already renamed
— `git grep "sandbox entrypoint"` has zero hits outside the generated
client). This kills the last 4 generated `sandbox entrypoint session`
doc-comments and moves the client from generator 7.12.0 to the pinned
7.23.0, same modernization #721 did for analytics (hence the
`src/docs/*.md` additions — 7.23 emits them, and the drift gate requires
committed == emitted).

Determinism verified: regen run twice locally (with and without
`--excludeTaskDependencies`), byte-identical both times.

**Drift gate now covers it** (`api-client-drift.yml`): regen via
`--excludeTaskDependencies` so the committed daemon swagger is the
contract and the job needs no Go/swag toolchain. Daemon-source↔swagger
drift stays ungated (the cli/daemon-docs sibling gate noted in #711
remains a follow-up). actionlint + shellcheck clean.

## Why the toolbox client was never regenerated: broken nx paths

The regen target failed outright: `-i
apps/daemon/pkg/toolbox/docs/swagger.json` resolves relative to the nx
workspace root, which *is* `apps/` → `apps/apps/daemon/...` (spec not
found). Kept from upstream daytona's repo layout; #716 fixed only the
product clients' targets. Fixed here:

- `libs/toolbox-api-client/project.json` — `-i
daemon/pkg/toolbox/docs/swagger.json`
- `libs/runner-api-client/project.json` — same latent bug (`-i
runner/...` + its `{workspaceRoot}` input)
- `nx.json` — `apiClient`/`goProduction` named inputs pointed at
`{workspaceRoot}/apps/...` paths that don't exist, so swagger/go.work
changes never invalidated task caches

## Functional config fixes

- **`scripts/test/e2e/bootstrap.sh` +
`apps/infra-local/configs/api.env`** wrote
`ADMIN_MAX_{CPU,MEMORY,DISK}_PER_SANDBOX`, but the API reads
`ADMIN_MAX_*_PER_BOX` (`apps/api/src/config/configuration.ts:292-294`)
with default `0` — admin-org per-box quotas were silently unset.
- **`apps/infra-local/scripts/stack-reset.sh` + README runbook
snippets** ran `TRUNCATE TABLE sandbox, ...` / `SELECT ... FROM sandbox`
— that table was renamed to `box` by migration `1781016743403`, so these
failed as written. Also `/api/sandbox` → `/api/box` (route is
`@Controller('box')`) and `{{sandboxId}}` → `{{boxId}}` (matches the
`configuration.dto.ts` example). infra-local merged in #595 on a
pre-#706 vocabulary.

## Vocabulary sweep (no behavior change)

Comments, docstrings, and three e2e test function names
(`test_*_above_per_sandbox_limit_*` → `per_box`; no `-k` selector,
workflow, or Makefile references them) across `scripts/test/e2e/`,
`scripts/deploy/runner-update-binary.sh`, and `apps/infra-local/`.
File/path references verified against the tree (`box.service.ts`,
`volume.manager.ts:47`, `box_sync.go`, `CREATE_BOX` journal tokens). All
three trees now grep-clean for `sandbox`.

Also includes 3 files prettier-normalized by the repo's `make lint:fix`
pre-commit autofixer (`eslint.config.mjs`, `Sidebar.tsx`,
`Onboarding.tsx`) — they were out of format on `main` and the repo-wide
hook re-applies them on every commit until committed.

## Verification

- Regen byte-identical across repeated runs, including the exact CI
invocation
- `actionlint` + `shellcheck` on the workflow; `shellcheck` on all 6
edited shell scripts (only pre-existing findings on untouched lines);
`py_compile` on all 7 edited Python files
- Every text replacement applied with an exact-unique-match assertion
(count==1 before replace)
- OS-isolation uses of "sandbox" (jailer/seatbelt/bwrap, docs/faq)
deliberately untouched — different concept per the rename's scope

Signed-off-by: dorianzheng <xingzhengde72@gmail.com>