feat(deploy): per-service deploy queue, cancellable deployments, no-cache builds

- internal/deployqueue: serialized FIFO per service — concurrent deploys
  of one service no longer race (the container-name-conflict failure
  mode); different services still run in parallel.
- Deploys and rollbacks enqueue through the queue; a busy service
  returns status 'queued' and promotes when the active job finishes.
- POST /deployments/:id/cancel — queued jobs drop immediately
  (200 cancelled); active jobs get ctx cancelled so build/reconcile
  abort (202 cancelling, settles 'cancelled'); finished deployments
  return 409 NOT_CANCELLABLE.
- Redeploy and variables save now route through the same queue so they
  can't overlap a build; PUT /services/:id/variables accepts
  redeploy:true to apply env changes to running containers.
- no_cache on deployment create plumbs BuildRequest -> BuildOptions for
  nixpacks, dockerfile and railpack builders.
- CLI: deployments cancel, deploy --no-cache, variables set/unset
  --redeploy. MCP: containr_deployments_cancel; deploy/variables_set
  document no_cache/redeploy. UI: Cancel button + queued/cancelled
  badges on the deployments table. OpenAPI + types regenerated.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/guides/CLI.md

@@ -38,11 +38,11 @@ auth login|logout|status         token auth and profiles
 tokens list|create|revoke        personal access tokens
 projects list|get|create|delete
 services list|get|create|delete|start|stop|restart|redeploy
-deploy <service-id>              trigger a deployment
-deployments list|get|logs|rollback
+deploy <service-id>              trigger a deployment (--no-cache, --commit-hash, --branch)
+deployments list|get|logs|rollback|cancel
 logs <service-id> [--follow]     runtime logs (SSE follow)
 exec <service-id> -- <cmd>       one-off container command
-variables list|set|unset         env vars (secrets masked)
+variables list|set|unset         env vars (secrets masked; --redeploy applies them)
 databases list|get|create|delete|action|backup|restore|download-backup
 cron list|get|create|delete|trigger|executions
 templates list|get|create|delete|deploy
@@ -95,3 +95,8 @@ Client configuration (Claude Code, Cursor, Devin, any stdio MCP host):
 
 Scope the token deliberately: `read` is enough for inspection agents,
 `write` for deploy automation, `admin` only for platform operations.
+
+Deployments are serialized per service: a second `deploy` on a busy
+service lands in `queued` state and runs when the active one finishes.
+`deployments cancel <id>` drops a queued deployment or aborts a running
+one (builds/reconciles stop via context cancellation).