Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/settings/users/index.server.ts

@@ -0,0 +1,30 @@
+import type { PagePropsType } from "@/src/types";
+import type { BunextPageServerFn } from "@moduletrace/bunext/types";
+import { SettingsDefaultPath } from "@/src/dict/settings-pages-dict";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import canListUsers from "@/src/utils/rbac/can-list-users";
+import grabUsers from "@/src/functions/backend/db/users/grab-users";
+import grabSettingsServerProps from "../(functions)/grab-settings-server-props";
+
+/**
+ * For those who may list users (`canListUsers`: super admins, admins);
+ * everyone else lands on the general settings.
+ */
+export const server: BunextPageServerFn<PagePropsType> = async (params) => {
+    const settings = await grabSettingsServerProps(params);
+
+    if (!settings.props) return settings;
+
+    const { user_types } = await userAuth({ req: params.req });
+
+    if (!canListUsers({ user_types })) {
+        return { redirect: { destination: SettingsDefaultPath, permanent: false } };
+    }
+
+    return {
+        props: {
+            ...settings.props,
+            persons: (await grabUsers()).payload || [],
+        },
+    };
+};