feat: enforce per-container memory/CPU limits

CONTAINER_MEMORY_MB and CONTAINER_CPUS (defaults 512/1) are now applied
to every installed MCP container's HostConfig instead of leaving them
unbounded.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -24,3 +24,7 @@ SESSION_SECRET=change-me-too
 # Random string (min 32 chars) used to derive the AES-256-GCM key that encrypts
 # installation env vars and bearer tokens at rest
 MASTER_KEY=change-me-to-a-random-string-of-at-least-32-characters
+
+# Resource caps applied to every installed MCP container (same limit for all, no per-installation override in V1)
+CONTAINER_MEMORY_MB=512
+CONTAINER_CPUS=1