Feat/enable autoresume for byoc

[matthewlouisbrockman]

allows edge clients to check the api for autoresume using grpc over tls using the existing api_secret

when a request comes into the edge proxy, if the sandbox isn't present, it calls home to the main API to see if it can autoresume. if it can autoresume, the main api resumes the sandbox and returns the info back to the edge proxy.

                           E2B CONTROL PLANE
                     +--------------------------+
                     | API                      |
                     |                          |
                     | ResumeSandbox gRPC       |
                     | api-grpc.<domain>        |
                     +------------+-------------+
                                  ^      |
                                  |      |
                                  |      | 3. API asks BYOC orchestrator
                                  |      |    to resume/start sandbox
                                  |      v
BYOC / EDGE DATA PLANE            |  +---------------------------+
+----------------------------------|--| edge orchestrator node   |-----------+
|                                  |  | starts/resumes sandbox   |           |
|                                  |  | updates sandbox catalog  |           |
|                                  |  +------------+--------------+           |
|                                  |               |                          |
|                                  |               | resumed sandbox           |
|                                  |               v                          |
|                                  |  +---------------------------+           |
|                                  |  | sandbox app / envd        |           |
|                                  |  +---------------------------+           |
|                                  |                                          |
|  user traffic                    |                                          |
|      |                           |                                          |
|      v                           |                                          |
|  +-------------------+           |                                          |
|  | BYOC LB / DNS     |           |                                          |
|  +---------+---------+           |                                          |
|            |                     |                                          |
|            v                     |                                          |
|  +-------------------+           |                                          |
|  | edge proxy        |           |                                          |
|  | client-proxy bin  |           |                                          |
|  +---------+---------+           |                                          |
|            |                     |                                          |
|            | 1. lookup sandbox   |                                          |
|            v                     |                                          |
|  +-------------------+           |                                          |
|  | edge catalog      |           |                                          |
|  | sandbox -> node   |           |                                          |
|  +----+---------+----+           |                                          |
|       |         |                |                                          |
|       | hit     | miss           |                                          |
|       |         |                |                                          |
|       |         v                |                                          |
|       |   +-------------------------------+                                 |
|       |   | 2. auto-resume path           |                                 |
|       |   | edge proxy calls API          |                                 |
|       |   | ResumeSandbox(sandbox, port)  |---------------------------------+
|       |   | + edge/proxy auth             |
|       |   | + forwarded request auth      |
|       |   +---------------+---------------+
|       |                   |
|       |                   | 4. API returns node route
|       |                   |    catalog is now populated
|       |                   v
|       |          +-----------------------------+
|       +--------->| edge orchestrator node      |
|                  | orchestrator proxy          |
|                  +-------------+---------------+
|                                |
|                                | 5. original request continues
|                                |    to requested sandbox port
|                                |    e.g. 80 / 3000 / envd
|                                v
|                  +-----------------------------+
|                  | sandbox app / envd          |
|                  +-----------------------------+
|                                                                       |
+-----------------------------------------------------------------------+

[cursor]

PR Summary

High Risk
Adds a new externally reachable API gRPC entrypoint and uses shared secrets to authorize ResumeSandbox calls, plus changes sandbox routing behavior; mistakes could expose resume functionality or break sandbox traffic routing.

Overview
Enables BYOC/edge client-proxy to auto-resume paused sandboxes by calling the control-plane API over gRPC (optionally TLS) with a new x-e2b-client-proxy-auth header backed by API_SECRET (cluster- or global-scoped). This also wires up infrastructure to expose and rate-limit api-grpc.<domain> (Traefik/GCP LB, firewall, new api_grpc_port plumbing), propagates node IPs from remote service discovery for data-plane routing, tightens error handling when routing info is missing, and adds per-destination proxy retry overrides for resumed sandboxes.

^{Reviewed by Cursor Bugbot for commit 7a93b62. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sitole]

@matthewlouisbrockman, can you please share a diagram explaining wiring things together?

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0cdff28. Configure here.}