feat: enforce per-container memory/CPU limits

CONTAINER_MEMORY_MB and CONTAINER_CPUS (defaults 512/1) are now applied
to every installed MCP container's HostConfig instead of leaving them
unbounded.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/server/src/config/env.ts

@@ -14,4 +14,7 @@ export const config = {
   publicBaseUrl: process.env.PUBLIC_BASE_URL ?? `http://localhost:${process.env.PORT ?? 3000}`,
   adminPassword: process.env.ADMIN_PASSWORD,
   sessionSecret: process.env.SESSION_SECRET,
+  // Per-container resource caps, applied to every installation (no per-installation override in V1).
+  containerMemoryMb: Number(process.env.CONTAINER_MEMORY_MB ?? 512),
+  containerCpus: Number(process.env.CONTAINER_CPUS ?? 1),
 };