Run computers with resources and health checks, add settings for bots, workspaces, computers and users

- Computers get CPUs and memory (default 1 CPU, 2 GB), set at creation and
  editable; new resources stop, remove and recreate the container, its home
  dir kept. Every computer container has a docker health check and stays
  "creating" until it passes; only healthy computers are reached, by
  hostname, else by their IP on the network (dev outside docker).
- Docker is required: the app creates the cobble network on startup and
  exits without docker.
- Production container: deploy/run-app-container.sh mounts .env, the data
  dir and the docker socket; the database (DB_DIR), media, computers' homes
  and bun-sqlite's live schema now live on the data volume.
- Settings pages for bots, workspaces, computers and users, sharing list
  components; bots can be deleted; users are created with a password and
  confirmation, edited and deleted through RBAC-gated APIs.
- User types trimmed to super_admin, admin, member, read_only and revoked;
  admins manage members. UserAvatar shows profile photos from the user row.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/schemas/user-schema.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import { UserTypes } from "@/src/dict/user-types-dict";
+
+export const SaveUserRequestSchema = z
+    .object({
+    /**
+     * Updates this user; creates one when not given.
+     */
+    user_id: z.coerce.number().int().positive().nullish(),
+    first_name: z.string().trim().min(1, "Enter their first name").max(100),
+    last_name: z.string().trim().max(100).default(""),
+    email: z.email("Enter a valid email address"),
+    username: z.string().trim().min(3, "Usernames must be at least 3 characters").max(32, "Usernames must be at most 32 characters"),
+    /**
+     * Required for a new user; on an existing one, empty keeps theirs.
+     */
+    password: z.string().max(128).default(""),
+    confirm_password: z.string().max(128).default(""),
+    /**
+     * Every user type they should hold (`UserTypes`). Types the actor may
+     * not grant or remove (`super_admin`, the assignment matrix) are left
+     * as they are.
+     */
+    user_types: z.array(z.enum(UserTypes.map((type) => type.value))).default([]),
+    })
+    .refine((data) => data.password == data.confirm_password, {
+        message: "The passwords don't match",
+        path: ["confirm_password"],
+    });
+
+export type SaveUserRequest = z.infer<typeof SaveUserRequestSchema>;
+
+export const UserIdRequestSchema = z.object({
+    user_id: z.coerce.number().int().positive("Pick a user"),
+});
+
+export type UserIdRequest = z.infer<typeof UserIdRequestSchema>;