Add Vercel sandboxes with Tailscale and bounded leases

[czpython]

Adds provider: "vercel" for named Vercel sandboxes with Tailscale SSH. The provider creates a nonpersistent sandbox from a prepared VCR image, runs bounded bootstrap, and deletes by stable name. Failed starts and lost create responses trigger cleanup. An Ubuntu image and deployment guide are included.

Vercel has a fixed session lifetime. Each host now stores and returns a generic lease_deadline: default leases, renewals, and pool claims stay within it; permanent or longer explicit leases return 400 HOST_LEASE. The stored limit cannot grow when provider settings change. The migration adds one nullable column. The default Vercel session is 45 minutes, with a 60-second lease margin and provisioning time included.

Research: Vercel images, session duration, and the official SDK API client.

Validation:

• Full SQLite suite: 795 passed; final provider, lease, and pool checks: 56 passed.
• Full PostgreSQL suite: 796 passed.
• Ruff, format check, and Pyright passed.
• Migration upgrade, downgrade, upgrade, and schema comparison passed on PostgreSQL and SQLite.
• Sandbox Docker image build passed. CI includes a separate image check.

No live Vercel provisioning, VCR publication, or tailnet SSH connection was tested. Deploy the prepared image to VCR and run migrations before use. Userspace Tailscale does not route ordinary application traffic; the secrets proxy must have a reachable outbound address. There is no snapshot or resume support.