feat: add CPU and memory resource limits per app

- Add cpu_limit (REAL) and memory_limit (INTEGER) columns to apps table
  via migration 007
- Add CPULimit and MemoryLimit fields to App model with full CRUD support
- Add resource limits fields to app edit form with human-friendly
  memory input (e.g. 256m, 1g, 512k)
- Pass CPU and memory limits to Docker container creation via
  NanoCPUs and Memory host config fields
- Extract Docker container creation helpers (buildEnvSlice, buildMounts,
  buildResources) for cleaner code
- Add formatMemoryBytes template function for display
- Add comprehensive tests for parsing, formatting, model persistence,
  and container options

internal/models/app.go

@@ -14,7 +14,8 @@ import (
 const appColumns = `id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id, created_at, updated_at`
+			previous_image_id, cpu_limit, memory_limit,
+			created_at, updated_at`
 
 // AppStatus represents the status of an app.
 type AppStatus string
@@ -47,6 +48,8 @@ type App struct {
 	DockerNetwork     sql.NullString
 	NtfyTopic         sql.NullString
 	SlackWebhook      sql.NullString
+	CPULimit          sql.NullFloat64
+	MemoryLimit       sql.NullInt64
 	CreatedAt         time.Time
 	UpdatedAt         time.Time
 }
@@ -142,14 +145,14 @@ func (a *App) insert(ctx context.Context) error {
 			id, name, repo_url, branch, dockerfile_path, webhook_secret,
 			ssh_private_key, ssh_public_key, image_id, status,
 			docker_network, ntfy_topic, slack_webhook, webhook_secret_hash,
-			previous_image_id
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+			previous_image_id, cpu_limit, memory_limit
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
 
 	_, err := a.db.Exec(ctx, query,
 		a.ID, a.Name, a.RepoURL, a.Branch, a.DockerfilePath, a.WebhookSecret,
 		a.SSHPrivateKey, a.SSHPublicKey, a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook, a.WebhookSecretHash,
-		a.PreviousImageID,
+		a.PreviousImageID, a.CPULimit, a.MemoryLimit,
 	)
 	if err != nil {
 		return err
@@ -165,6 +168,7 @@ func (a *App) update(ctx context.Context) error {
 			image_id = ?, status = ?,
 			docker_network = ?, ntfy_topic = ?, slack_webhook = ?,
 			previous_image_id = ?,
+			cpu_limit = ?, memory_limit = ?,
 			updated_at = CURRENT_TIMESTAMP
 		WHERE id = ?`
 
@@ -173,6 +177,7 @@ func (a *App) update(ctx context.Context) error {
 		a.ImageID, a.Status,
 		a.DockerNetwork, a.NtfyTopic, a.SlackWebhook,
 		a.PreviousImageID,
+		a.CPULimit, a.MemoryLimit,
 		a.ID,
 	)
 
@@ -188,6 +193,7 @@ func (a *App) scan(row *sql.Row) error {
 		&a.DockerNetwork, &a.NtfyTopic, &a.SlackWebhook,
 		&a.WebhookSecretHash,
 		&a.PreviousImageID,
+		&a.CPULimit, &a.MemoryLimit,
 		&a.CreatedAt, &a.UpdatedAt,
 	)
 }
@@ -206,6 +212,7 @@ func scanApps(appDB *database.Database, rows *sql.Rows) ([]*App, error) {
 			&app.DockerNetwork, &app.NtfyTopic, &app.SlackWebhook,
 			&app.WebhookSecretHash,
 			&app.PreviousImageID,
+			&app.CPULimit, &app.MemoryLimit,
 			&app.CreatedAt, &app.UpdatedAt,
 		)
 		if scanErr != nil {