Clear refusals instead of 500 errors on sandbox create

A create that asks for ports beyond 80 and 443 (network.connect) from an account without a kept top-up is refused with 403 connect_not_allowed, saying what lifts it, and a maxTotalCostMicros below the first minutes a paid sandbox holds is refused with 400 invalid_request naming that field; both answered 500 before. A pause sent while a sandbox is still starting, a wake sent while it is pausing, and a restart sent while it is stopping now wait for it instead of being refused, and a file call right after a wake waits for the sandbox to listen instead of answering guest_busy. A persistent sandbox stopped before it ever started now reads diskKept: false, since it has no disk to restart from; it read true, and its restart was refused. See networking, limits and the API guide.