Forward SSH gateway channels to sandbox loopback

[czpython]

The SSH gateway refused every direct-tcpip channel. Thus a client could not reach the Chat bridge or VNC on the sandbox loopback.

The gateway now accepts a channel to 127.0.0.1 or localhost and refuses all other destinations. It forwards the channel through an SSH tunnel into the sandbox. The provider opens this tunnel with open_gateway_tunnel. For docker-sbx, the tunnel goes through sbx ssh proxy to sandboxd. sandboxd authenticates the OS user on its local socket, so the gateway uses no key. All channels of one caller connection share one tunnel, and it closes when the caller disconnects.

The sandbox image does not change. The gateway runs no process in the sandbox for forwarding.

sandboxd has two limits:

• sandboxd accepts a channel to a closed port and then closes it immediately. Thus the client gets an immediate end of data, not ChannelOpenError. A client that starts a missing service must treat an immediate end of data as "not running".
• sandboxd does not forward to ::1. The channel stays open with no data. Thus the gateway refuses ::1.

Validation:

• uv run pytest: 734 passed on SQLite. Ruff, format checks, and Pyright passed.
• New gateway tests use a local SSH server in place of sandboxd. They cover a 1 MiB binary transfer with half-close, refused destinations, one shared tunnel that closes with the caller, and a tunnel that fails to open.
• On sbx v0.45.1, the gateway and DockerSbxProvider.open_gateway_tunnel forwarded to a real sandbox. A 4 MiB transfer with half-close passed. localhost passed. ::1 and 10.0.0.1 were refused. The sbx ssh proxy process stopped after the caller disconnected.
• A proxy connection woke a stopped sandbox in 0.2 seconds.

Not tested: the Chat and VNC workflows, the images/sbx image, and Postgres.

Fixes #56.

The change also applies the review checklist to gateway/server.py. GatewayConnection.host has no None default, cast replaces the assert isinstance checks, the single-use host-key and SFTP-extension helpers are inlined, and sftp_backend() is now get_sftp_backend().