Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/layouts/bots/(partials)/rail-settings-list.tsx

@@ -12,7 +12,8 @@ type Props = {
 
 /**
  * Settings mode of the rail: back to the bots, then the settings sub pages
- * (super admin pages only for super admins).
+ * (super admin pages only for super admins, RBAC-gated pages by their
+ * own rule).
  */
 export default function RailSettingsList({ pathname }: Props) {
     const { pageProps } = useContext(AppContext);
@@ -25,8 +26,10 @@ export default function RailSettingsList({ pathname }: Props) {
         <>
             <RailBackLink />
             <Divider className="shrink-0 mx-1 lg:mx-3 my-2 w-auto border-hairline dark:border-hairline" />
-            {SettingsPages.filter(
-                (page) => is_super_admin || !page.super_admin_only,
+            {SettingsPages.filter((page) =>
+                page.can_view
+                    ? page.can_view({ user_types: pageProps?.user_types })
+                    : is_super_admin || !page.super_admin_only,
             ).map((page) => (
                 <RailSettingsLink
                     key={page.url}