refactor(agents): sink sandbox.py into filesystem subsystem

shared/sandbox.py was used only by the filesystem middleware/tools (and the
boundary) -- never by main_agent or subagents as shared code. Move it next to
its only agent-side consumer:

  multi_agent_chat/shared/sandbox.py
  -> multi_agent_chat/shared/middleware/filesystem/sandbox.py

surfsense_backend/app/agents/chat/multi_agent_chat/shared/middleware/filesystem/middleware/middleware.py

@@ -8,7 +8,9 @@ from deepagents import FilesystemMiddleware
 from langchain_core.tools import BaseTool
 
 from app.agents.chat.multi_agent_chat.shared.filesystem_selection import FilesystemMode
-from app.agents.chat.multi_agent_chat.shared.sandbox import is_sandbox_enabled
+from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
+    is_sandbox_enabled,
+)
 from app.agents.chat.multi_agent_chat.shared.state.filesystem_state import (
     SurfSenseFilesystemState,
 )

surfsense_backend/app/agents/chat/multi_agent_chat/shared/middleware/filesystem/tools/execute_code/helpers.py

@@ -14,7 +14,7 @@ from typing import TYPE_CHECKING
 from daytona.common.errors import DaytonaError
 from langchain.tools import ToolRuntime
 
-from app.agents.chat.multi_agent_chat.shared.sandbox import (
+from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
     _evict_sandbox_cache,
     delete_sandbox,
     get_or_create_sandbox,

surfsense_backend/app/routes/new_chat_routes.py

@@ -476,7 +476,7 @@ async def _revert_turns_for_regenerate(
 
 def _try_delete_sandbox(thread_id: int) -> None:
     """Fire-and-forget sandbox + local file deletion so the HTTP response isn't blocked."""
-    from app.agents.chat.multi_agent_chat.shared.sandbox import (
+    from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
         delete_local_sandbox_files,
         delete_sandbox,
         is_sandbox_enabled,

surfsense_backend/app/routes/sandbox_routes.py

@@ -51,7 +51,7 @@ async def download_sandbox_file(
 ):
     """Download a file from the Daytona sandbox associated with a chat thread."""
 
-    from app.agents.chat.multi_agent_chat.shared.sandbox import (
+    from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
         get_or_create_sandbox,
         is_sandbox_enabled,
     )
@@ -74,7 +74,9 @@ async def download_sandbox_file(
         "You don't have permission to access files in this thread",
     )
 
-    from app.agents.chat.multi_agent_chat.shared.sandbox import get_local_sandbox_file
+    from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
+        get_local_sandbox_file,
+    )
 
     # Prefer locally-persisted copy (sandbox may already be deleted)
     local_content = get_local_sandbox_file(thread_id, path)

surfsense_backend/app/tasks/chat/streaming/flows/new_chat/orchestrator.py

@@ -829,7 +829,7 @@ async def stream_new_chat(
         # downloadable after the Daytona sandbox auto-deletes.
         if stream_result and stream_result.sandbox_files:
             with contextlib.suppress(Exception):
-                from app.agents.chat.multi_agent_chat.shared.sandbox import (
+                from app.agents.chat.multi_agent_chat.shared.middleware.filesystem.sandbox import (
                     is_sandbox_enabled,
                     persist_and_delete_sandbox,
                 )