Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/user-types-dict.test.ts

@@ -19,6 +19,7 @@ describe("UserTypes dict", () => {
         const required = [
             "super_admin",
             "admin",
+            "member",
             "revoked",
             "read_only",
         ] as const;
@@ -48,28 +49,18 @@ describe("Assignment matrices", () => {
         ).toBeUndefined();
     });
 
-    test("elevated types are pass-through only", () => {
-        const elevated = [
-            "admin",
-            "president",
-            "vice_president",
-            "secretary",
-        ] as const;
-        for (const type of elevated) {
-            const entry = UserTypeAssignmentMatrix[type];
-            expect(Array.isArray(entry.allowed_actors)).toBe(true);
-            expect((entry.allowed_actors as string[]).length).toBe(0);
+    test("admin is granted by pass-through actors only", () => {
+        const entry = UserTypeAssignmentMatrix["admin"];
+        expect(Array.isArray(entry.allowed_actors)).toBe(true);
+        expect((entry.allowed_actors as string[]).length).toBe(0);
+    });
+
+    test("admin manages member types, never on admins or the super admin", () => {
+        for (const type of ["member", "read_only", "revoked"] as const) {
+            for (const matrix of [UserTypeAssignmentMatrix, UserTypeDeletionMatrix]) {
+                const rules = (matrix[type].allowed_actors as Record<string, { excluded_targets?: string[] }>).admin;
+                expect(rules?.excluded_targets).toEqual(["super_admin", "admin"]);
+            }
         }
     });
-
-    test("admin can manage auditor but not another admin", () => {
-        expect(
-            UserTypeAssignmentMatrix["auditor"].allowed_actors,
-        ).toContain("admin");
-
-        expect(
-            (UserTypeAssignmentMatrix["admin"].allowed_actors as string[])
-                .length,
-        ).toBe(0);
-    });
 });