feat(worker): per-user box status and lifecycle helpers

Centralize per-user box home-path derivation, status inspection, and
lifecycle (start/stop/restart) in a new box.ts so the HTTP routes and the
terminal WS bridge share one source of truth. Add inspectUserBoxStatus to
docker.ts (single `inspect --format` call, all-null/false on non-zero exit)
and resetBox to user-container.ts (clears the idle timer and drops the
registry entry so a stopped box isn't treated as held).

Manual verification (docker required, after Task 4 wires the routes): with
the worker running and a box up,
`curl -H "Authorization: Bearer $TOKEN" localhost:3921/box/status?user=<you>`
shows running:true + image + startedAt; `POST /box/lifecycle {"action":"stop"}`
flips status to running:false; `start` brings it back.

apps/agent-worker/src/box.ts

@@ -0,0 +1,45 @@
+import path from 'node:path';
+
+import { env } from './env';
+import {
+  ensureUserContainer,
+  inspectUserBoxStatus,
+  stopWorkspaceContainer,
+  userContainerName,
+} from './runtime/docker';
+import { resetBox } from './user-container';
+
+// Per-user box home layout, shared by the HTTP routes and the terminal WS bridge
+// so path derivation lives in exactly one place (must match worker.ts).
+export const boxHomePaths = (username: string) => ({
+  homeDir: path.resolve(env.workdir, 'homes', username),
+  containerHome: path.posix.join('/home', username),
+});
+
+export type BoxStatus = {
+  running: boolean;
+  image: string | null;
+  startedAt: string | null;
+  memoryLimitBytes: number | null;
+  containerName: string;
+};
+
+export const getBoxStatus = async (username: string): Promise<BoxStatus> => {
+  const status = await inspectUserBoxStatus(username);
+  return { ...status, containerName: userContainerName(username) };
+};
+
+export const startBox = async (username: string): Promise<void> => {
+  const { homeDir, containerHome } = boxHomePaths(username);
+  await ensureUserContainer({ username, workdir: homeDir, containerHome });
+};
+
+export const stopBox = async (username: string): Promise<void> => {
+  await stopWorkspaceContainer(userContainerName(username));
+  resetBox(username);
+};
+
+export const restartBox = async (username: string): Promise<void> => {
+  await stopBox(username);
+  await startBox(username);
+};