Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/server/computers/computer-proxy-target.ts

@@ -1,6 +1,7 @@
 import grabComputerMcpUrl from "@/src/functions/backend/db/computers/grab-computer-mcp-url";
 import grabUserComputer from "@/src/functions/backend/db/computers/grab-user-computer";
 import userAuth from "@/src/functions/backend/auth/user-auth";
+import computerNotReadyMessage from "@/src/utils/computer-not-ready-message";
 import parseComputerProxyPath from "@/src/utils/parse-computer-proxy-path";
 
 type Params = {
@@ -10,8 +11,8 @@ type Params = {
 /**
  * Where a `/computers/<id>/...` request goes: the computer's own address
  * for that path, only for the computer's owner. An error response when
- * the user isn't logged in, the computer isn't theirs, or it has no
- * container.
+ * the user isn't logged in, the computer isn't theirs, it has no
+ * container, or it isn't ready.
  */
 export default async function computerProxyTarget({ req }: Params) {
     const url = new URL(req.url);
@@ -36,6 +37,10 @@ export default async function computerProxyTarget({ req }: Params) {
         return { error: new Response("This computer has no container.", { status: 502 }) };
     }
 
+    if (!address.ready) {
+        return { error: new Response(computerNotReadyMessage(address), { status: 503 }) };
+    }
+
     return {
         session,
         url,