Adds a dedicated Sandbox settings page under the AI settings, letting
users review and manage the elevated terminal sandbox permissions that
are always allowed without prompting.

The page exposes:
- Network: an "Allow All Domains" toggle and an editable list of allowed
domains (exact domains or leading-`*.` subdomain wildcards), with
validation.
- Filesystem: an "Allow All Filesystem Writes" toggle and an editable
list of writable paths.
- Sandbox: an "Allow Unsandboxed Terminal Commands" toggle.

This replaces the single "Allow Unsandboxed Terminal Commands" setting
item with the new page, and updates the agent panel's settings shortcut
to open it. "Allow always" sandbox grants now persist to settings only
and are no longer also cached as an in-memory thread grant.

Closes AI-413

Release Notes:

- Added a settings page for managing the agent terminal sandbox
permissions (allowed domains, writable paths, and unsandboxed command
execution).