refactor: move SQL queries from auth handler to repo

refactor: standardize API response

feat: implement ephemeral sandbox auth with auto cleanup