fix: redirect to login on session expiry (SessionGuard + middleware 401)

feat: full omo agent/category config in sandbox UserData

fix: create oh-my-opencode.jsonc in UserData (omo global config)

fix: support same-account Route53 DNS (no cross-account role needed)

feat: multi-env deploy script (envs/ + scripts/deploy-env.sh)

fix: sanitize target group name (replace non-alphanumeric chars)

feat: add omo plugin setup to sandbox UserData (opencode.json + install)

feat: add software_init provisioning step, wait for UserData completion

feat: sandbox creation with name+slug, slug display in card/detail

feat: slug-based provisioning + changeSlug with DNS/ALB update

feat: add slug field to Sandbox (name=display, slug=ID for domains)

feat: deployment detail UI, approvals page, pipeline visualizer

feat: deployment pipeline + approval API routes

feat: deployment manager (state transitions, QA, approvals)

feat: add Service, PipelineDeployment, Approval, QA types