add sandbox stub service - 4-route placeholder until real soul wires up

Go HTTP server with five handlers:
  GET  /             -> 200 {env, status, soul}
  GET  /health       -> 200 {ok:true}
  POST /api/share    -> 410 not_available_in_sandbox
  GET  /said         -> 410 not_available_in_sandbox
  GET  /share/*      -> 410 not_available_in_sandbox
  any  other         -> 404 not_found

Distroless final image. Cross-compiled on host (Apple Silicon QEMU + Go
crashes with lfstack.push when go build runs inside an emulated linux/amd64
container). Pushed to us-central1-docker.pkg.dev/neuron-785695/neuron-sandbox/sandbox:initial.

Replaced when the real soul build pipeline lands.

.gitignore

@@ -0,0 +1,3 @@
+build/
+*.tfplan
+.DS_Store