Limit the app container to 1 CPU and 2 GB, and stop stale caches

The app container is now created with --cpus 1 --memory 2048m: the heavy
work happens in the computers' own containers, so the orchestrator does
not need more. Both are installer flags (--cpus, --memory), kept in
install.conf, and part of the idempotency check, so an existing install
picks them up on its next update.

The env and app-setting caches lived in module variables, and bunext
bundles pages and API routes separately. A save cleared only its own
copy, so a saved provider key never reached the page that lists models
until the process restarted. They now share one slot per name on
globalThis, behind a symbol from the global registry, with the pattern
extracted into a tested helper.

src/utils/global-cache.ts

@@ -0,0 +1,41 @@
+/**
+ * A per-process cache slot that survives module duplication.
+ *
+ * bunext bundles pages and API routes separately, so a module-scoped `let`
+ * cache exists once per bundle: a save that clears its own copy leaves the
+ * other one serving stale data until the process restarts (a saved API key
+ * never reached the model list). The key is taken from the global symbol
+ * registry, which resolves to the same symbol in every bundle, and the value
+ * is stored on `globalThis`, so every copy reads and clears one slot.
+ */
+type Slot<Value> = {
+    get(): Value | undefined;
+    set(value: Value): void;
+    clear(): void;
+};
+
+/**
+ * Named caches, so two modules never share a slot by accident.
+ */
+export type GlobalCacheName =
+    | "cobble.grabAllEnvs.cache"
+    | "cobble.grabAppSettings.cache";
+
+export default function globalCache<Value>({
+    name,
+}: {
+    name: GlobalCacheName;
+}): Slot<Value> {
+    const key = Symbol.for(name);
+    const holder = globalThis as Record<symbol, Value | undefined>;
+
+    return {
+        get: () => holder[key],
+        set: (value: Value) => {
+            holder[key] = value;
+        },
+        clear: () => {
+            delete holder[key];
+        },
+    };
+}