feat(proxy): forward native gRPC over h2c to sandbox backends

[Deep-Axe]

Summary

• Public sandbox URLs are HTTPS vhosts on :443, not a raw TCP mapping of the guest port. Native gRPC needs HTTP/2 to the process inside the sandbox; the pool transport still defaults to HTTP/1.1 so browsers, python -m http.server, and VNC /ws keep working.
• Detect native gRPC by Content-Type (application/grpc / application/grpc+…, not application/grpc-web) and send those requests over h2c. Shared dialUpstream retries still cover envd/socat startup.
• Announce gRPC trailers and drop Content-Length so HTTP/1.1 hops in front of the proxy can still surface grpc-status.
• Nomad IAC (Traefik/GCP/AWS edge matchers) is gone on current main. This PR only changes the Go proxy. If the new LB ever protocol-selects on Content-Type, it must not prefix-match application/grpc (that would include grpc-web).
  Suggested matcher is documented in tests: (?)^application/grpc($|[+;].*).

Closes e2b-dev/desktop#114

Test plan

• go test ./packages/shared/pkg/proxy/pool ./packages/shared/pkg/proxy
• HTTP and WebSocket to a sandbox port still work
• From a system, grpc.secure_channel(sandbox.get_grpc_target(50051), grpc.ssl_channel_credentials()) against a guest gRPC server succeeds after this is deployed
• grpc-web / ordinary HTTP is unchanged