Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/user-types-dict.ts

@@ -1,29 +1,33 @@
 import type { UserType, UserTypeAssignmentMatrixType } from "../types";
 
+/**
+ * Every user type on this install. A user needs at least one to sign in.
+ */
 export const UserTypes = [
     {
         value: "super_admin",
+        title: "Super admin",
+        description: "Runs the install: models, environment, computers and users. The first account.",
     },
     {
         value: "admin",
+        title: "Admin",
+        description: "Adds and manages members.",
     },
     {
-        value: "auditor",
-    },
-    {
-        value: "president",
-    },
-    {
-        value: "vice_president",
-    },
-    {
-        value: "secretary",
-    },
-    {
-        value: "revoked",
+        value: "member",
+        title: "Member",
+        description: "Has their own crew, workspaces and main computer.",
     },
     {
         value: "read_only",
+        title: "Read only",
+        description: "Can look around, but can't change anything.",
+    },
+    {
+        value: "revoked",
+        title: "Revoked",
+        description: "Can't sign in. Their crew and files are kept.",
     },
 ] as const;
 
@@ -58,36 +62,24 @@ export const UserTypeAssignmentMatrix: UserTypeAssignmentMatrixType = {
     admin: {
         allowed_actors: [],
     },
-    president: {
-        allowed_actors: [],
-    },
-    vice_president: {
-        allowed_actors: [],
-    },
-    secretary: {
-        allowed_actors: [],
-    },
-    auditor: {
-        allowed_actors: ["admin"],
+    member: {
+        allowed_actors: {
+            admin: {
+                excluded_targets: ["super_admin", "admin"],
+            },
+        },
     },
     read_only: {
         allowed_actors: {
             admin: {
-                excluded_targets: ["super_admin"],
+                excluded_targets: ["super_admin", "admin"],
             },
         },
     },
     revoked: {
         allowed_actors: {
             admin: {
-                allowed_targets: ["read_only"],
-                excluded_targets: [
-                    "super_admin",
-                    "admin",
-                    "president",
-                    "vice_president",
-                    "secretary",
-                ],
+                excluded_targets: ["super_admin", "admin"],
             },
         },
     },
@@ -98,36 +90,24 @@ export const UserTypeDeletionMatrix: UserTypeAssignmentMatrixType = {
     admin: {
         allowed_actors: [],
     },
-    president: {
-        allowed_actors: [],
-    },
-    vice_president: {
-        allowed_actors: [],
-    },
-    secretary: {
-        allowed_actors: [],
-    },
-    auditor: {
-        allowed_actors: ["admin"],
+    member: {
+        allowed_actors: {
+            admin: {
+                excluded_targets: ["super_admin", "admin"],
+            },
+        },
     },
     read_only: {
         allowed_actors: {
             admin: {
-                excluded_targets: ["super_admin"],
+                excluded_targets: ["super_admin", "admin"],
             },
         },
     },
     revoked: {
         allowed_actors: {
             admin: {
-                allowed_targets: ["read_only"],
-                excluded_targets: [
-                    "super_admin",
-                    "admin",
-                    "president",
-                    "vice_president",
-                    "secretary",
-                ],
+                excluded_targets: ["super_admin", "admin"],
             },
         },
     },