Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/deploy-prod.sh

@@ -20,7 +20,7 @@ if [ ! -f "$ENV_FILE" ]; then
     exit 1
 fi
 
-DEPLOY_NAME="bunext-sqlite"
+DEPLOY_NAME="cobble"
 SOURCE_PATH="${SOURCE_DIRECTORY:-$(read_env_var SOURCE_DIRECTORY)}"
 SERVER_IP="${DEPLOY_SERVER_IP:-$(read_env_var DEPLOY_SERVER_IP)}"
 SSH_USER="${SSH_USER:-$(read_env_var SSH_USER)}"
@@ -60,17 +60,6 @@ set -euo pipefail
 DEPLOY_NAME="$1"
 
 cd "/docker/$DEPLOY_NAME"
-docker build -t "$DEPLOY_NAME" .
-
-docker rm -f "$DEPLOY_NAME" 2>/dev/null || true
-
-docker run --name "$DEPLOY_NAME" -d \
-  --network cloudflare \
-  -v "/data/$DEPLOY_NAME/.data:/data" \
-  --cpus 1 --memory 1g \
-  --env-file "/docker/$DEPLOY_NAME/.env" \
-  --restart unless-stopped \
-  "$DEPLOY_NAME:latest"
-
-docker image prune -f
+COBBLE_DATA_DIR="/data/$DEPLOY_NAME/.data" COBBLE_EXTRA_NETWORK=cloudflare \
+  ./deploy/run-app-container.sh
 EOF

deploy/run-app-container.sh

@@ -0,0 +1,59 @@
+#!/bin/bash
+# Builds the app's image and (re)starts its container. Rerun it to update:
+# the database, media and computers' home directories (the data dir) and
+# .env stay on the host. The container needs the docker socket, since it
+# creates every computer as a container on the cobble network.
+#
+#   COBBLE_DATA_DIR       host data dir, mounted at /data (default /data/cobble)
+#   COBBLE_BIND           host address the app is published on (default 127.0.0.1)
+#   COBBLE_EXTRA_NETWORK  another docker network to join, e.g. a tunnel's
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENV_FILE="$PROJECT_ROOT/.env"
+NAME="cobble"
+NETWORK="cobble"
+DATA_PATH="${COBBLE_DATA_DIR:-/data/cobble}"
+BIND="${COBBLE_BIND:-127.0.0.1}"
+DOCKER_SOCKET="/var/run/docker.sock"
+
+if [ ! -f "$ENV_FILE" ]; then
+    echo "Error: $ENV_FILE not found. Copy .env.example and set ENCRYPTION_KEY and ENCRYPTION_SALT." >&2
+    exit 1
+fi
+
+if [ ! -S "$DOCKER_SOCKET" ]; then
+    echo "Error: no docker socket at $DOCKER_SOCKET. Computers run in docker, so the app needs it." >&2
+    exit 1
+fi
+
+PORT="$(grep -E '^[[:space:]]*PORT=' "$ENV_FILE" | tail -n 1 | cut -d= -f2- | tr -d "\"' \r")"
+PORT="${PORT:-7227}"
+
+mkdir -p "$DATA_PATH"
+
+docker network inspect "$NETWORK" >/dev/null 2>&1 || docker network create "$NETWORK" >/dev/null
+
+docker build -t "$NAME" "$PROJECT_ROOT"
+
+docker stop -t 30 "$NAME" >/dev/null 2>&1 || true
+docker rm -f "$NAME" >/dev/null 2>&1 || true
+
+docker run --name "$NAME" -d \
+  --network "$NETWORK" \
+  -p "$BIND:$PORT:$PORT" \
+  -v "$ENV_FILE:/app/.env:ro" \
+  -v "$DATA_PATH:/data" \
+  -v "$DOCKER_SOCKET:$DOCKER_SOCKET" \
+  -e MAIN_SERVER=1 \
+  --cpus 1 --memory 1g \
+  --restart unless-stopped \
+  "$NAME:latest"
+
+if [ -n "${COBBLE_EXTRA_NETWORK:-}" ]; then
+    docker network connect "$COBBLE_EXTRA_NETWORK" "$NAME"
+fi
+
+docker image prune -f >/dev/null
+
+echo "Cobble is starting on http://$BIND:$PORT (data in $DATA_PATH)"