Stop the Sandbox app from its panel, and end it after ten idle minutes #119

Parent

#27 (M6 General sensors)

Spec: docs/specs/general-sensors.md (added by PR #111; read it there until it merges). Parent: #27.

What to build

A Stop button in the Sandbox Panel, shown only when running as the app, posts to a Sandbox-only route that ends the process. The route refuses a non-loopback client and a foreign Origin. After Stop the page says it's safe to close. The app also ends itself after 10 minutes with no /api/state request (the Node's clock, so tests don't wait). Both paths remove the temp folder. Security review wanted (a route that ends the process): route it through Leia, the pod has no security specialist. Spec decision 7 (stopping).

Acceptance criteria

• Stop ends the process and removes its temp folder.
• The route refuses a foreign Origin and a non-loopback client.
• Outside the app the Stop button isn't shown and the route doesn't exist.
• With no /api/state request for 10 minutes the app ends itself and removes its temp folder (fake clock or short interval).
• After Stop the page says it is safe to close.
• scripts/check.sh passes.

Blockers are native links.