feat: add per-server bash sandbox

[tomasmach]

Summary

• add opt-in per-server bash_exec tool with DM disablement and config validation
• add authenticated vespra-runnerd Docker job runner and sandbox request/result package
• wire bash settings into the web API/UI, Docker assets, and README

Verification

• go test -tags sqlite_fts5 ./...
• go build -tags sqlite_fts5 -o /tmp/vespra-build-check .
• go build -tags sqlite_fts5 -o /tmp/vespra-runnerd-build-check ./cmd/vespra-runnerd
• docker compose config

Notes

• Full Docker sandbox execution was not run; it requires building the job image and launching Docker job containers on the host.