Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/computers/create-computer.ts

@@ -17,6 +17,15 @@ type Params = {
      * `main` only for the owner's one main computer (`ensureMainComputer`).
      */
     kind?: ComputerKind;
+    /**
+     * CPU cores its container may use. Defaults to `AppData.ComputerDefaultCpus`.
+     */
+    cpus?: number;
+    /**
+     * Its container's memory limit in MB. Defaults to
+     * `AppData.ComputerDefaultMemoryMb`.
+     */
+    memory_mb?: number;
 };
 
 /**
@@ -24,7 +33,8 @@ type Params = {
  * (`<AppData.ComputerContainerPrefix>-<id>`), then sets the container up
  * in the background (`provisionComputer`). Returns the computer at once,
  * still `creating`, and the setup to await when the caller must (a CLI
- * script). The main computer of a server that reaches it at
+ * script). Its resources (`cpus`, `memory_mb`) are saved on the computer
+ * and applied to its container whenever it is set up. The main computer of a server that reaches it at
  * `MAIN_COMPUTER_URL` (a dev server) gets no container of its own.
  */
 export default async function createComputer({
@@ -32,6 +42,8 @@ export default async function createComputer({
     name,
     description,
     kind = "sandbox",
+    cpus = AppData.ComputerDefaultCpus,
+    memory_mb = AppData.ComputerDefaultMemoryMb,
 }: Params) {
     const external = kind == "main" && Boolean((await grabEnv({ key: "MAIN_COMPUTER_URL" }))?.trim());
 
@@ -70,6 +82,8 @@ export default async function createComputer({
                 name,
                 description: description || undefined,
                 kind,
+                cpus,
+                memory_mb,
             },
         ],
     });