Surface sandbox failures in `app status` and `miren doctor`

Problem

Users have no CLI-visible signal that their app's sandboxes are crash-looping. On James's server, miren app list showed gleester as deployed even while postgres was completely broken and cycling through 15+ dead sandboxes.

Concrete Improvements

app status

• Show per-service sandbox health: running vs dead counts, recent restart count
• Flag services in a crash loop (e.g. "postgres: crash-looping, 5 failures in last 10 minutes")
• Show last exit code and a snippet of the last failure's logs

miren doctor

• Check for orphaned entities (index entries pointing to missing store entries)
• Check for services with elevated dead sandbox counts
• Check for pools stuck in a failing state
• Report disk/volume health issues if applicable