feat: add CPU and memory resource limits per app

- Add cpu_limit (REAL) and memory_limit (INTEGER) columns to apps table
  via migration 007
- Add CPULimit and MemoryLimit fields to App model with full CRUD support
- Add resource limits fields to app edit form with human-friendly
  memory input (e.g. 256m, 1g, 512k)
- Pass CPU and memory limits to Docker container creation via
  NanoCPUs and Memory host config fields
- Extract Docker container creation helpers (buildEnvSlice, buildMounts,
  buildResources) for cleaner code
- Add formatMemoryBytes template function for display
- Add comprehensive tests for parsing, formatting, model persistence,
  and container options

internal/docker/client.go

@@ -138,13 +138,15 @@ func (c *Client) BuildImage(
 
 // CreateContainerOptions contains options for creating a container.
 type CreateContainerOptions struct {
-	Name    string
-	Image   string
-	Env     map[string]string
-	Labels  map[string]string
-	Volumes []VolumeMount
-	Ports   []PortMapping
-	Network string
+	Name        string
+	Image       string
+	Env         map[string]string
+	Labels      map[string]string
+	Volumes     []VolumeMount
+	Ports       []PortMapping
+	Network     string
+	CPULimit    float64 // CPU cores (e.g. 0.5 = half a core, 2.0 = two cores). 0 means unlimited.
+	MemoryLimit int64   // Memory in bytes. 0 means unlimited.
 }
 
 // VolumeMount represents a volume mount.
@@ -161,6 +163,14 @@ type PortMapping struct {
 	Protocol      string // "tcp" or "udp"
 }
 
+// nanoCPUsPerCPU is the number of NanoCPUs per CPU core.
+const nanoCPUsPerCPU = 1e9
+
+// cpuLimitToNanoCPUs converts a CPU limit (e.g. 0.5 cores) to Docker NanoCPUs.
+func cpuLimitToNanoCPUs(cpuLimit float64) int64 {
+	return int64(cpuLimit * nanoCPUsPerCPU)
+}
+
 // buildPortConfig converts port mappings to Docker port configuration.
 func buildPortConfig(ports []PortMapping) (nat.PortSet, nat.PortMap) {
 	exposedPorts := make(nat.PortSet)
@@ -185,6 +195,48 @@ func buildPortConfig(ports []PortMapping) (nat.PortSet, nat.PortMap) {
 	return exposedPorts, portBindings
 }
 
+// buildEnvSlice converts an env map to a Docker-compatible env slice.
+func buildEnvSlice(env map[string]string) []string {
+	envSlice := make([]string, 0, len(env))
+
+	for key, val := range env {
+		envSlice = append(envSlice, key+"="+val)
+	}
+
+	return envSlice
+}
+
+// buildMounts converts volume mounts to Docker mount configuration.
+func buildMounts(volumes []VolumeMount) []mount.Mount {
+	mounts := make([]mount.Mount, 0, len(volumes))
+
+	for _, vol := range volumes {
+		mounts = append(mounts, mount.Mount{
+			Type:     mount.TypeBind,
+			Source:   vol.HostPath,
+			Target:   vol.ContainerPath,
+			ReadOnly: vol.ReadOnly,
+		})
+	}
+
+	return mounts
+}
+
+// buildResources builds Docker resource constraints from container options.
+func buildResources(opts CreateContainerOptions) container.Resources {
+	resources := container.Resources{}
+
+	if opts.CPULimit > 0 {
+		resources.NanoCPUs = cpuLimitToNanoCPUs(opts.CPULimit)
+	}
+
+	if opts.MemoryLimit > 0 {
+		resources.Memory = opts.MemoryLimit
+	}
+
+	return resources
+}
+
 // CreateContainer creates a new container.
 func (c *Client) CreateContainer(
 	ctx context.Context,
@@ -196,40 +248,20 @@ func (c *Client) CreateContainer(
 
 	c.log.Info("creating container", "name", opts.Name, "image", opts.Image)
 
-	// Convert env map to slice
-	envSlice := make([]string, 0, len(opts.Env))
-
-	for key, val := range opts.Env {
-		envSlice = append(envSlice, key+"="+val)
-	}
-
-	// Convert volumes to mounts
-	mounts := make([]mount.Mount, 0, len(opts.Volumes))
-
-	for _, vol := range opts.Volumes {
-		mounts = append(mounts, mount.Mount{
-			Type:     mount.TypeBind,
-			Source:   vol.HostPath,
-			Target:   vol.ContainerPath,
-			ReadOnly: vol.ReadOnly,
-		})
-	}
-
-	// Convert ports to exposed ports and port bindings
 	exposedPorts, portBindings := buildPortConfig(opts.Ports)
 
-	// Create container
 	resp, err := c.docker.ContainerCreate(ctx,
 		&container.Config{
 			Image:        opts.Image,
-			Env:          envSlice,
+			Env:          buildEnvSlice(opts.Env),
 			Labels:       opts.Labels,
 			ExposedPorts: exposedPorts,
 		},
 		&container.HostConfig{
-			Mounts:       mounts,
+			Mounts:       buildMounts(opts.Volumes),
 			PortBindings: portBindings,
 			NetworkMode:  container.NetworkMode(opts.Network),
+			Resources:    buildResources(opts),
 			RestartPolicy: container.RestartPolicy{
 				Name: container.RestartPolicyUnlessStopped,
 			},