Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

db/schema.ts

@@ -893,6 +893,11 @@ const schema: BUN_SQLITE_DatabaseSchemaType = {
                     fieldDescription: `Address the main container reaches it on`,
                     dataType: "TEXT",
                 },
+                {
+                    fieldName: "ip_address",
+                    fieldDescription: `Its IP address on the network, tried when the hostname can't be reached (a dev server outside docker)`,
+                    dataType: "TEXT",
+                },
                 {
                     fieldName: "port",
                     fieldDescription: `Port the service listens on inside the container`,
@@ -960,6 +965,16 @@ const schema: BUN_SQLITE_DatabaseSchemaType = {
                     fieldName: "description",
                     dataType: "TEXT",
                 },
+                {
+                    fieldName: "cpus",
+                    fieldDescription: `CPU cores the container may use (docker NanoCpus), set when the computer is created`,
+                    dataType: "REAL",
+                },
+                {
+                    fieldName: "memory_mb",
+                    fieldDescription: `Memory limit of the container in MB, set when the computer is created`,
+                    dataType: "INTEGER",
+                },
             ],
             indexes: [
                 {