Add a Box client and per-conversation box pool #97

The cloud computer platform's own container fan-out (OpenAgentsInc/openagents project 1) is still in the runtime-provider phase. As a shortcut for the Ox Alpha stress fleet, use the Box VM API (https://docs.ascii.dev/box/api/v1) as the execution substrate.

Add the server-side foundation:

• A Req-based client for the Box Public API v1 at https://ascii.dev/api/box/v1: create box, get box, list boxes, stop box, resume box, execute command, and write file. Authenticate with a bearer key from the BOX_API_KEY runtime environment variable. Surface the structured error envelope (code, status, message) as typed errors.
• A per-conversation box ledger (Ecto table) that records each box a conversation creates, its Box id, state, and lifecycle timestamps.
• A quota: at most 10 active boxes per conversation. Creating an 11th returns a typed refusal.
• Idempotency keys on create so a lost response cannot provision a second billable box.
• Bounded readiness polling after create (boxes report ready in about a second; poll with a hard cap).
• Treat desktopUrl and other token-bearing URLs as secrets: never store or return them.

Verified against a live trial account: POST /boxes returns a ready Hetzner VM (4 vCPU, 8 GB) in about one second, and POST /boxes/{id}/commands returns {exitCode, stdout, stderr, timedOut} in about one second.