Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

bun-sqlite.config.ts

@@ -1,10 +1,18 @@
+import path from "path";
 import type { BunSQLiteConfig } from "@moduletrace/bun-sqlite/types";
 
+/**
+ * The database lives in `DB_DIR` when it's set (the app's container puts
+ * it on the data volume, so it survives updates), else in `./db`. The
+ * schema always comes from the code, `db/schema.ts`.
+ */
+const db_dir = process.env.DB_DIR || "./db";
+
 const config: BunSQLiteConfig = {
     db_name: "cobble",
-    db_dir: "./db",
+    db_dir,
     typedef_file_path: "./db/types/db.ts",
-    db_schema_file_name: "schema.ts",
+    db_schema_file_name: path.relative(path.resolve(db_dir), path.resolve("db/schema.ts")),
 };
 
 export default config;