Show node diagnostics, E2B template builds, suspension policy and E2B disk

[SaladDay]

Wires the sandbox fields the backend delivered in #115 and #118 into the console. It only reads fields already on main, so it merges on its own.

• Node diagnostics. Each fixed code gets a short reason and a one-line fix, in en and zh-CN:

  • docker_unavailable
  • docker_limits_unsupported
  • runtime_image_unavailable
  • kvm_unavailable
  • microsandbox_artifacts_unavailable
  • capacity_insufficient
  • provider_unavailable, also used for any unknown code

  A degraded node shows the reason in the help tip beside its status: node page, Nodes list, Sandbox metrics table and node dialog, Overview node popover.

• E2B template build. System, the Sandbox backend summary and Sandbox metrics show the build's status and size (CPU · memory · disk). When specification.resources is missing, the size comes from the template build.

• E2B setup. The flow is where → E2B account → review, with no size step. The request sends no resources, and Core fills them from the template. The same applies when changing the provider to E2B in maintenance.

• Suspension (microsandbox). System and the Sandbox backend summary show "Suspend after idle" and "Keep suspended for", e.g. 5 minutes and 24 hours. Docker and E2B show nothing.

• E2B disk. The sandbox dialog shows disk used / limit when observation.disk is present.

• Docs: protocol-coverage.md, PRODUCT.md, and the setup section of DESIGN.md.

Validation: typecheck, 331 web unit tests, 15 browser acceptance tests on headless Chromium, run on top of main 2c97e3e2.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}