fix(api): add nil guard in volume mount response conversion

Problem

In packages/api/internal/handlers/sandboxes_list.go, convertFromDBMountsToAPIMounts converts database volume mount slice items into API response structs (api.SandboxVolumeMount). If the input slice contains a nil element (e.g. unmarshaled from JSONB payloads containing sparse/null entries), accessing item.Name or item.Path triggers a nil pointer dereference panic, failing the active HTTP request goroutine for sandbox GET/LIST endpoints.

Root Cause

convertFromDBMountsToAPIMounts iterated directly over mounts without checking if item == nil.

Reproduction Steps

1. Invoke convertFromDBMountsToAPIMounts([]*dbtypes.SandboxVolumeMountConfig{nil}).
2. Observed result: Nil pointer dereference panic.
3. Expected result: Skips nil item, returns empty slice pointer.

mounts := []*dbtypes.SandboxVolumeMountConfig{nil}
res := convertFromDBMountsToAPIMounts(mounts) // panics on item.Name

Technical Context

• Files affected: packages/api/internal/handlers/sandboxes_list.go, packages/api/internal/handlers/volume_util_test.go
• Subsystem: Control Plane API
• Impact: Low/Medium (Defensive nil safety)

Proposed Changes

Start in packages/api/internal/handlers/sandboxes_list.go at convertFromDBMountsToAPIMounts, then review the related cases in packages/api/internal/handlers/volume_util_test.go. Run the handler tests and add coverage for a nil mount element. Done means sparse input no longer panics and nil entries are omitted from the API response.