Slice 2: port 3452, nginx sandbox mount, AGENTS.md, docs, deploy script cleanup

- control-plane default listen addr is now :3452 (was :8080). An
  unusual port to avoid collisions on the VM.
- agent-micro and agent-gateway default SDP_CP_URL points at
  ws://localhost:3452/ws/agent. docker-compose.yml updates the
  control plane command, host port mapping, and agent -cp URLs.
- nginx/nginx.conf (the legacy root-mount reference) uses
  127.0.0.1:3452 for the upstream. nginx/sandbox.conf is the new
  deployment config: four location blocks for the /sandbox/credit-card
  mount — _next/static serves cached chunks, /api/ and /ws/ proxy
  to 127.0.0.1:3452, /sandbox/credit-card serves the static
  dashboard with try_files for SPA routing.
- scripts/patch-nginx.sh: deleted. The user configures nginx on 186
  by hand. scripts/deploy.sh no longer calls it.
- AGENTS.md: new file. Documents the build/lint/test commands
  (with the golang:1.24-alpine container — local Go can't fetch
  the toolchain), the wire protocol, the Slice-2 conventions
  (sdp-<repo> container naming, snapshot persistence,
  PreGitReset/AfterStart hooks), the repo-path gotcha, and the
  build-artifacts-in-git rationale.
- dashboard/out: now tracked in git, alongside bin/. The dashboard
  static export is scp'd to 186 on deploy; the VMs have no
  internet so they can't regenerate it. .gitignore comment
  explains this and warns against re-ignoring.
- README.md / REQUIREMENTS.md: status updated to 'Slice 2 done',
  per-feature checklist marked. Erangel repo path corrected to
  /var/www/html/erangel-ocean (was wrongly ~/SDP in earlier docs).

docker-compose.yml

@@ -10,12 +10,12 @@ services:
     image: alpine:latest
     container_name: sdp-control-plane
     restart: unless-stopped
-    command: ["/SDP/bin/control-plane", "-addr", ":8080", "-data", "/SDP/data"]
+    command: ["/SDP/bin/control-plane", "-addr", ":3452", "-data", "/SDP/data"]
     volumes:
       - ./bin/control-plane:/SDP/bin/control-plane:ro
       - sdp-data:/SDP/data
     ports:
-      - "8080:8080"
+      - "3452:3452"
 
   agent-micro:
     image: alpine:latest
@@ -28,7 +28,7 @@ services:
       - -node
       - micro
       - -cp
-      - ws://control-plane:8080/ws/agent
+      - ws://control-plane:3452/ws/agent
     volumes:
       - ./bin/agent-micro:/SDP/bin/agent-micro:ro
       - /var/run/docker.sock:/var/run/docker.sock
@@ -48,7 +48,7 @@ services:
       - -node
       - gateway
       - -cp
-      - ws://control-plane:8080/ws/agent
+      - ws://control-plane:3452/ws/agent
     volumes:
       - ./bin/agent-gateway:/SDP/bin/agent-gateway:ro
       - /var/run/docker.sock:/var/run/docker.sock