Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/settings-pages-dict.ts

@@ -1,11 +1,17 @@
 import {
+    Bot,
     CpuAi,
     KeyRound,
+    Layers,
+    Monitor,
+    Users,
     SlidersHorizontal,
     UserRound,
     Variable,
     type LucideIcon,
 } from "lucide-react";
+import type { BUN_SQLITE_COBBLE_USER_TYPES } from "@/db/types/db";
+import canListUsers from "@/src/utils/rbac/can-list-users";
 
 export type SettingsPage = {
     title: string;
@@ -15,8 +21,14 @@ export type SettingsPage = {
      * Shown and served to super admins only.
      */
     super_admin_only?: boolean;
+    /**
+     * Who sees it, when that's an RBAC rule rather than super admins only.
+     */
+    can_view?: (params: { user_types?: BUN_SQLITE_COBBLE_USER_TYPES[] | null }) => boolean;
 };
 
+export const SettingsComputersPath = "/admin/settings/computers";
+
 /**
  * The `/admin/settings/*` sub pages, listed in the rail on every settings
  * page. The first one is where `/admin/settings` lands.
@@ -33,6 +45,15 @@ export const SettingsPages: SettingsPage[] = [
         url: "/admin/settings/change-password",
         Icon: KeyRound,
     },
+    { title: "Bots", url: "/admin/settings/bots", Icon: Bot },
+    { title: "Workspaces", url: "/admin/settings/workspaces", Icon: Layers },
+    { title: "Computers", url: SettingsComputersPath, Icon: Monitor },
+    {
+        title: "Users",
+        url: "/admin/settings/users",
+        Icon: Users,
+        can_view: canListUsers,
+    },
     {
         title: "Models",
         url: "/admin/settings/models",