fix(server): skip auth for proxy-to-sandbox paths; strict path matching

[Pangjiping]

Summary

• Do not validate OPEN-SANDBOX-API-KEY when request is proxied to sandbox
  (/sandboxes/{id}/proxy/... or /v1/sandboxes/{id}/proxy/...).
• Use strict regex for exempt path to avoid false positives
  (e.g. /proxy/sandboxes/... no longer exempt).
• Reject paths containing '..' to prevent path traversal auth bypass.
• Add _is_proxy_path() and tests for exemption and security cases.

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation. fix Bug: HealthAdapter missing authentication headers when use_server_proxy=True, causing health check to always fail with 401 #248
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered