Sandbox runs on /sandbox-wp · browsing only — no login, edits, uploads, or file downloads