extract shared mosis-core library from sandbox APIs

Create core/ directory with platform-agnostic sandbox components:
- Timer manager, JSON API, Crypto API, Virtual FS
- Lua sandbox, Permission gate, Audit log, Rate limiter
- Platform abstraction interfaces (IAssetInterface, IFilesystemInterface)
- Platform-agnostic logger with Android/Desktop implementations

Update designer to link against mosis-core library instead of
including sandbox sources directly.

This is the foundation for unifying the Android service and
desktop designer to share the same codebase.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

core/include/mosis/sandbox/crypto_api.h

@@ -0,0 +1,52 @@
+#pragma once
+
+#include <string>
+#include <cstdint>
+#include <random>
+#include <mutex>
+
+struct lua_State;
+
+namespace mosis {
+
+// Per-app cryptographically secure RNG
+class SecureRandom {
+public:
+    SecureRandom();
+
+    // Get random bytes as binary string
+    std::string GetBytes(size_t count);
+
+    // Get random integer in range [min, max]
+    int64_t GetInt(int64_t min, int64_t max);
+
+    // Get random double in range [0.0, 1.0)
+    double GetDouble();
+
+private:
+    std::random_device m_rd;
+    std::mt19937_64 m_gen;
+    std::mutex m_mutex;
+};
+
+// Hash algorithms supported
+enum class HashAlgorithm {
+    SHA256,
+    SHA512,
+    SHA1,
+    MD5
+};
+
+// Compute hash of data
+std::string ComputeHash(HashAlgorithm algo, const std::string& data);
+
+// Compute HMAC of data with key
+std::string ComputeHMAC(HashAlgorithm algo, const std::string& key, const std::string& data);
+
+// Register crypto.* APIs as globals
+void RegisterCryptoAPI(lua_State* L);
+
+// Register secure math.random replacement (removes math.randomseed)
+void RegisterSecureMathRandom(lua_State* L, SecureRandom* rng);
+
+} // namespace mosis