Slice 2: port 3452, nginx sandbox mount, AGENTS.md, docs, deploy script cleanup

- control-plane default listen addr is now :3452 (was :8080). An
  unusual port to avoid collisions on the VM.
- agent-micro and agent-gateway default SDP_CP_URL points at
  ws://localhost:3452/ws/agent. docker-compose.yml updates the
  control plane command, host port mapping, and agent -cp URLs.
- nginx/nginx.conf (the legacy root-mount reference) uses
  127.0.0.1:3452 for the upstream. nginx/sandbox.conf is the new
  deployment config: four location blocks for the /sandbox/credit-card
  mount — _next/static serves cached chunks, /api/ and /ws/ proxy
  to 127.0.0.1:3452, /sandbox/credit-card serves the static
  dashboard with try_files for SPA routing.
- scripts/patch-nginx.sh: deleted. The user configures nginx on 186
  by hand. scripts/deploy.sh no longer calls it.
- AGENTS.md: new file. Documents the build/lint/test commands
  (with the golang:1.24-alpine container — local Go can't fetch
  the toolchain), the wire protocol, the Slice-2 conventions
  (sdp-<repo> container naming, snapshot persistence,
  PreGitReset/AfterStart hooks), the repo-path gotcha, and the
  build-artifacts-in-git rationale.
- dashboard/out: now tracked in git, alongside bin/. The dashboard
  static export is scp'd to 186 on deploy; the VMs have no
  internet so they can't regenerate it. .gitignore comment
  explains this and warns against re-ignoring.
- README.md / REQUIREMENTS.md: status updated to 'Slice 2 done',
  per-feature checklist marked. Erangel repo path corrected to
  /var/www/html/erangel-ocean (was wrongly ~/SDP in earlier docs).

nginx/nginx.conf

@@ -1,11 +1,12 @@
-# SDP nginx — serves the static NextJS export and proxies API + WS
-# to the Go control plane.
+# SDP nginx — reference config for serving the dashboard at the host
+# root. The actual deployment on 186 mounts the dashboard under
+# /sandbox/credit-card; see nginx/sandbox.conf for that.
 #
 # try_files: any unknown path falls back to /index.html so client-side
 # routing works. /api and /ws are matched first and proxied upstream.
 
 upstream control_plane {
-    server 127.0.0.1:8080;
+    server 127.0.0.1:3452;
     keepalive 16;
 }
 

nginx/sandbox.conf

@@ -0,0 +1,47 @@
+# SDP nginx for 186 — mount the dashboard under /sandbox/credit-card
+# and proxy /api/ + /ws/ to the control plane on 127.0.0.1:3452.
+#
+# Splice the four location blocks into the existing
+# /etc/nginx/sites-available/default server { } on 186. Order doesn't
+# matter for these specific prefixes (they're disjoint), but
+# longest-prefix-first is the convention.
+#
+# Verify with `sudo nginx -t` then `sudo systemctl reload nginx`.
+
+# Static asset chunks (hashed filenames, safe to cache forever).
+location /sandbox/credit-card/_next/static/ {
+    alias /home/administrator/SDP/dashboard/_next/static/;
+    expires 1y;
+    add_header Cache-Control "public, immutable";
+}
+
+# API: control plane on 127.0.0.1:3452. The proxy_pass has no path
+# component, so the original /api/... URI is forwarded unchanged.
+location /sandbox/credit-card/api/ {
+    proxy_pass http://127.0.0.1:3452;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_read_timeout 3600s;
+}
+
+# WebSocket: deployment log subscriptions + agent WS.
+location /sandbox/credit-card/ws/ {
+    proxy_pass http://127.0.0.1:3452;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_read_timeout 3600s;
+}
+
+# Everything else under /sandbox/credit-card: serve the static
+# dashboard. Client-side routes (e.g. /sandbox/credit-card/dashboard/sandboxes/abc)
+# fall through to /index.html, which Next.js hydrates and the React
+# Router takes over.
+location /sandbox/credit-card {
+    alias /home/administrator/SDP/dashboard/;
+    index index.html;
+    try_files $uri $uri/ $uri.html /index.html;
+}