feat: enforce per-container memory/CPU limits

CONTAINER_MEMORY_MB and CONTAINER_CPUS (defaults 512/1) are now applied
to every installed MCP container's HostConfig instead of leaving them
unbounded.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -13,6 +13,8 @@ services:
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
       SESSION_SECRET: ${SESSION_SECRET}
       MASTER_KEY: ${MASTER_KEY}
+      CONTAINER_MEMORY_MB: ${CONTAINER_MEMORY_MB:-512}
+      CONTAINER_CPUS: ${CONTAINER_CPUS:-1}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ./data:/repo/data