Expose a port inside a sandbox at a public HTTPS URL - the preview URL for a dev server [rate class: sandbox_api_rps]

Expose a port inside one of your SANDBOXES at a public HTTPS URL - the preview URL for a dev server, so the page an agent just wrote can be looked at (or curled, or driven by a browser) from outside. Returns {endpoint_id, url, sandbox, port, auth, expires_at}. Default auth is the capability URL itself: the hostname carries an unguessable secret, so anyone holding the URL reaches the port - treat it like a password. auth:"bearer" additionally requires Authorization: Bearer <token> at the edge; that token rides the response ONCE. THE SERVER HAS TO BE RUNNING AND ON LOOPBACK: bind 127.0.0.1 (the dev-server default) on a port in 1024-65535, and background it WITH ITS OUTPUT REDIRECTED - (npm run dev > /tmp/dev.log 2>&1 &) - because sandbox_exec waits for a command's output to end, so a bare npm run dev & hangs the exec and then dies with it. Exposing a port nothing listens on succeeds; the URL then answers 502 naming the port, so start the server first. Idempotent per (sandbox, port): the same call returns the same URL with a refreshed expiry, which makes it cheap to call in a loop. The endpoint belongs to THIS sandbox: a fork does not inherit it (a fork is a new sandbox - expose its own port), and deleting the sandbox kills the URL. An inbound request wakes a parked sandbox, so traffic puts it back on the active RAM tier. Raw byte pipe behind the URL: streaming, SSE and WebSocket all pass through. No vanity hostnames on sandbox endpoints (nodes have those); works even on a sandbox with egress:"none", because nothing dials out to serve it.