Add a rolling sandbox deployment for opted-in PRs

## Context
The backend plan includes a single sandbox environment for manual PR previews. This is useful but lower priority than product and mobile blockers.

## Scope
- Create a sandbox app and isolated database/storage settings.
- Add a GitHub Actions workflow gated by owner-authored PRs and an opt-in label.
- Refresh sandbox data safely on each deploy.
- Add smoke checks and document rollback behavior.

## Acceptance criteria
- Only eligible, explicitly opted-in PRs deploy to the sandbox.
- The sandbox never uses unsanitized production data.
- Deploy status and smoke results are visible in Actions.