Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/harness/tools/computer/open-computer-tools.ts

@@ -1,6 +1,7 @@
 import { ComputerMcpExcludedTools } from "@/src/dict/computer-dict";
 import grabComputerMcpUrl from "@/src/functions/backend/db/computers/grab-computer-mcp-url";
 import grabComputerEnvs from "@/src/functions/backend/db/envs/grab-computer-envs";
+import computerNotReadyMessage from "@/src/utils/computer-not-ready-message";
 import redactSecrets from "@/src/utils/redact-secrets";
 import connectMcpServer from "../../mcp/connect-mcp-server";
 import grabMcpTools from "../../mcp/grab-mcp-tools";
@@ -58,6 +59,10 @@ export default async function openComputerTools({
         throw new Error(`Computer #${computer_id} has no container to connect to.`);
     }
 
+    if (!target.ready) {
+        throw new Error(computerNotReadyMessage(target));
+    }
+
     const envs = await grabComputerEnvs({ computer_id, workspace_id });
     const paths = await writeComputerEnv({ base_url: target.base_url, envs, signal });
     const secrets = envs.filter((env) => env.secret);

src/harness/tools/computer/search-computers-tool.ts

@@ -4,6 +4,7 @@ import { AppData } from "@/src/data/app-data";
 import grabComputerMcpUrl from "@/src/functions/backend/db/computers/grab-computer-mcp-url";
 import grabComputerEnvs from "@/src/functions/backend/db/envs/grab-computer-envs";
 import computerRef from "@/src/utils/computer-ref";
+import computerNotReadyMessage from "@/src/utils/computer-not-ready-message";
 import redactSecrets from "@/src/utils/redact-secrets";
 import type { HarnessTool } from "../../types";
 import runComputerCommand from "./run-computer-command";
@@ -49,6 +50,8 @@ export default function searchComputersTool({
 
                         if (!target) return `${label}\nNot reachable: it has no container.`;
 
+                        if (!target.ready) return `${label}\nNot reachable: ${computerNotReadyMessage(target)}`;
+
                         const [result, envs] = await Promise.all([
                             runComputerCommand({
                                 base_url: target.base_url,