Disposable microVM control plane

Sign in to manage sandboxes and MCP agent access.

Session auth is reserved for the single admin account. Agents authenticate separately with bearer secrets at /mcp.