Run plugins in a QuickJS sandbox in the browser

Adds packages/plugin-sandbox: QuickJS-ng compiled to wasm, running in a
dedicated worker, with a runtime shell inside it that loads a plugin bundle
and answers the same InternalEventPayload events the Node runtime answers.
Plugins are unmodified.

Wires the browser host's template function, authentication, cURL import and
template render commands to it, and relaxes TemplateCallback's Send bound on
wasm32 so the engine's renderer can call back out to a plugin.

package-lock.json

@@ -16,6 +16,7 @@
         "packages/platform",
         "packages/plugin-runtime",
         "packages/plugin-runtime-types",
+        "packages/plugin-sandbox",
         "plugins-external/mcp-server",
         "plugins-external/faker",
         "plugins-external/httpsnippet",
@@ -1470,6 +1471,21 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@jitl/quickjs-ffi-types": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/@jitl/quickjs-ffi-types/-/quickjs-ffi-types-0.32.0.tgz",
+      "integrity": "sha512-v9T+GQpmk43VDJ7d72sf0Nexhk+ArvtUihW27dy7lqAl0zBObFKtSBBIm5RBjwIhE8VwsPPm9PNuvPvNqLWUEg==",
+      "license": "MIT"
+    },
+    "node_modules/@jitl/quickjs-ng-wasmfile-release-sync": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/@jitl/quickjs-ng-wasmfile-release-sync/-/quickjs-ng-wasmfile-release-sync-0.32.0.tgz",
+      "integrity": "sha512-XAX2jjZWWh3M0YaRqi82xMKNW/gkF6mo3MpW3UY2cmVxnQai1JuboVsJQVoLU629iEL4XWvHtO4h5lo7NRnAcg==",
+      "license": "MIT",
+      "dependencies": {
+        "@jitl/quickjs-ffi-types": "0.32.0"
+      }
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -5638,6 +5654,10 @@
       "resolved": "packages/plugin-runtime",
       "link": true
     },
+    "node_modules/@yaakapp-internal/plugin-sandbox": {
+      "resolved": "packages/plugin-sandbox",
+      "link": true
+    },
     "node_modules/@yaakapp-internal/plugins": {
       "resolved": "crates/yaak-plugins",
       "link": true
@@ -12799,6 +12819,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/quickjs-emscripten-core": {
+      "version": "0.32.0",
+      "resolved": "https://registry.npmjs.org/quickjs-emscripten-core/-/quickjs-emscripten-core-0.32.0.tgz",
+      "integrity": "sha512-QFnPfjFey8EqknSrSxe1hZrf1/8z7/6s1QzGOmKo6++02r7QRRX7ZoyNaZh7JuVjWsVW87KnQrbZqnHkOAzUyg==",
+      "license": "MIT",
+      "dependencies": {
+        "@jitl/quickjs-ffi-types": "0.32.0"
+      }
+    },
     "node_modules/railroad-diagrams": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
@@ -15859,6 +15888,17 @@
       "dev": true,
       "license": "MIT"
     },
+    "packages/plugin-sandbox": {
+      "name": "@yaakapp-internal/plugin-sandbox",
+      "version": "1.0.0",
+      "dependencies": {
+        "@jitl/quickjs-ng-wasmfile-release-sync": "^0.32.0",
+        "quickjs-emscripten-core": "^0.32.0"
+      },
+      "devDependencies": {
+        "esbuild": "^0.28.0"
+      }
+    },
     "packages/tailwind-config": {
       "name": "@yaakapp-internal/tailwind-config",
       "version": "1.0.0"