feat: add CPU and memory resource limits per app

- Add cpu_limit (REAL) and memory_limit (INTEGER) columns to apps table
  via migration 007
- Add CPULimit and MemoryLimit fields to App model with full CRUD support
- Add resource limits fields to app edit form with human-friendly
  memory input (e.g. 256m, 1g, 512k)
- Pass CPU and memory limits to Docker container creation via
  NanoCPUs and Memory host config fields
- Extract Docker container creation helpers (buildEnvSlice, buildMounts,
  buildResources) for cleaner code
- Add formatMemoryBytes template function for display
- Add comprehensive tests for parsing, formatting, model persistence,
  and container options

internal/models/app.go

@@ -14,7 +14,8 @@ import (
 const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, created_at, updated_at`
+			previous_image_id, cpu_limit, memory_limit,
+			created_at, updated_at`
 
 // AppStatus represents the status of an app.
 type AppStatus string
@@ -47,6 +48,8 @@ type App struct {
 	DockerNetwork     sql.NullString
 	NtfyTopic         sql.NullString
 	SlackWebhook      sql.NullString
+	CPULimit          sql.NullFloat64
+	MemoryLimit       sql.NullInt64
 	CreatedAt         time.Time
 	UpdatedAt         time.Time
 }
@@ -142,14 +145,14 @@ func (a *App) insert(ctx context.Context) error {
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			previous_image_id, cpu_limit, memory_limit
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 
 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID,
+		a.PreviousImageID, a.CPULimit, a.MemoryLimit,
 	)
 	if err != nil {
 		return err
@@ -165,6 +168,7 @@ func (a *App) update(ctx context.Context) error {
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
 			previous_image_id = ?,
+			cpu_limit = ?, memory_limit = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`
 
@@ -173,6 +177,7 @@ func (a *App) update(ctx context.Context) error {
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
 		a.PreviousImageID,
+		a.CPULimit, a.MemoryLimit,
 		a.ID,
 	)
 
@@ -188,6 +193,7 @@ func (a *App) scan(row *sql.Row) error {
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
 		&a.WebhookSecretHash,
 		&a.PreviousImageID,
+		&a.CPULimit, &a.MemoryLimit,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -206,6 +212,7 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
 			&app.WebhookSecretHash,
 			&app.PreviousImageID,
+			&app.CPULimit, &app.MemoryLimit,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {

internal/models/models_test.go

@@ -781,6 +781,96 @@ func TestCascadeDelete(t *testing.T) {
 	})
 }
 
+// Resource Limits Tests.
+
+func TestAppResourceLimits(t *testing.T) { //nolint:funlen // integration test with multiple subtests
+	t.Parallel()
+
+	t.Run("saves and loads CPU limit", func(t *testing.T) {
+		t.Parallel()
+
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		app := createTestApp(t, testDB)
+
+		app.CPULimit = sql.NullFloat64{Float64: 0.5, Valid: true}
+
+		err := app.Save(context.Background())
+		require.NoError(t, err)
+
+		found, err := models.FindApp(context.Background(), testDB, app.ID)
+		require.NoError(t, err)
+		require.NotNil(t, found)
+		assert.True(t, found.CPULimit.Valid)
+		assert.InDelta(t, 0.5, found.CPULimit.Float64, 0.001)
+	})
+
+	t.Run("saves and loads memory limit", func(t *testing.T) {
+		t.Parallel()
+
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		app := createTestApp(t, testDB)
+
+		app.MemoryLimit = sql.NullInt64{Int64: 536870912, Valid: true} // 512m
+
+		err := app.Save(context.Background())
+		require.NoError(t, err)
+
+		found, err := models.FindApp(context.Background(), testDB, app.ID)
+		require.NoError(t, err)
+		require.NotNil(t, found)
+		assert.True(t, found.MemoryLimit.Valid)
+		assert.Equal(t, int64(536870912), found.MemoryLimit.Int64)
+	})
+
+	t.Run("null limits by default", func(t *testing.T) {
+		t.Parallel()
+
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		app := createTestApp(t, testDB)
+
+		found, err := models.FindApp(context.Background(), testDB, app.ID)
+		require.NoError(t, err)
+		require.NotNil(t, found)
+		assert.False(t, found.CPULimit.Valid)
+		assert.False(t, found.MemoryLimit.Valid)
+	})
+
+	t.Run("clears limits when set to null", func(t *testing.T) {
+		t.Parallel()
+
+		testDB, cleanup := setupTestDB(t)
+		defer cleanup()
+
+		app := createTestApp(t, testDB)
+
+		// Set limits
+		app.CPULimit = sql.NullFloat64{Float64: 1.0, Valid: true}
+		app.MemoryLimit = sql.NullInt64{Int64: 1073741824, Valid: true} // 1g
+
+		err := app.Save(context.Background())
+		require.NoError(t, err)
+
+		// Clear limits
+		app.CPULimit = sql.NullFloat64{}
+		app.MemoryLimit = sql.NullInt64{}
+
+		err = app.Save(context.Background())
+		require.NoError(t, err)
+
+		found, err := models.FindApp(context.Background(), testDB, app.ID)
+		require.NoError(t, err)
+		require.NotNil(t, found)
+		assert.False(t, found.CPULimit.Valid)
+		assert.False(t, found.MemoryLimit.Valid)
+	})
+}
+
 // Helper function to create a test app.
 func createTestApp(t *testing.T, testDB *database.Database) *models.App {
 	t.Helper()