feat(services): builder selection, resource reservations, static builder (C3)

services.builder picks the build strategy per service: auto detects from
repo contents (Dockerfile → railpack → nixpacks), explicit overrides force
a builder, and static builds assets in a node stage then serves them from
an nginx image (static_build_cmd/static_dir, port 80 default).

- cpu_reserve/memory_reserve → Docker CPU shares + MemoryReservation;
  cpu/memory stay hard caps (NanoCPUs/Memory). Empty string clears.
- app_settings.default_cpu/default_memory override service-create
  fallbacks; capacity_policy=block fails deploys whose requested memory
  exceeds node capacity (default warn logs via slog).
- Resource specs are validated — "512mb" fails instead of silently
  dropping the limit.
- Fixes: deployments.go hardcoded nixpacks (auto-detect was dead code);
  DockerfileBuilder passed the Dockerfile *path* as build-context content;
  BuildImage never drained the daemon stream so builds could abort and
  errors went unseen — stream is now consumed and errorDetail surfaced.
- CLI: --builder/--cpu-reserve/--memory-reserve/--static-cmd/--static-dir
  on create+update; MCP args on services create/update; UI Build &
  Resources card; OpenAPI + llms.txt + CLI.md.

Verified live: static build of a real repo → nginx image → deployed;
reserves reach HostConfig (shares=256, MemoryReservation=128Mi);
validation rejects bad specs; builder persists + clears.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/backend/internal/deployment/engine.go

@@ -84,10 +84,11 @@ type VolumeMount struct {
 }
 
 type ResourceLimits struct {
-	MemoryBytes int64 `json:"memory_bytes,omitempty"`
-	CPUQuota    int64 `json:"cpu_quota,omitempty"`
-	CPUPeriod   int64 `json:"cpu_period,omitempty"`
-	CPUShares   int64 `json:"cpu_shares,omitempty"`
+	MemoryBytes       int64 `json:"memory_bytes,omitempty"`
+	MemoryReservation int64 `json:"memory_reservation,omitempty"`
+	CPUQuota          int64 `json:"cpu_quota,omitempty"`
+	CPUPeriod         int64 `json:"cpu_period,omitempty"`
+	CPUShares         int64 `json:"cpu_shares,omitempty"`
 }
 
 type HealthCheck struct {
@@ -152,6 +153,7 @@ type BuildConfig struct {
 	PrebuiltImage string            `json:"prebuilt_image"`
 	BuildCommand  string            `json:"build_command"`
 	StartCommand  string            `json:"start_command"`
+	BuildArgs     map[string]string `json:"build_args,omitempty"`
 	Environment   map[string]string `json:"environment"`
 	Branch        string            `json:"branch"`
 	Commit        string            `json:"commit"`
@@ -166,6 +168,12 @@ type TriggerConfig struct {
 	Timestamp time.Time         `json:"timestamp"` // When trigger occurred
 }
 
+// DockerClient exposes the engine's docker handle for read-only queries
+// (capacity checks, image info).
+func (de *DeploymentEngine) DockerClient() *docker.Client {
+	return de.dockerClient
+}
+
 func NewDeploymentEngine(buildManager *build.BuildManager, dockerClient *docker.Client) *DeploymentEngine {
 	return &DeploymentEngine{
 		buildManager:  buildManager,
@@ -290,6 +298,7 @@ func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployme
 		ImageTag:      deployment.ID,
 		BuildCommand:  buildConfig.BuildCommand,
 		StartCommand:  buildConfig.StartCommand,
+		BuildArgs:     buildConfig.BuildArgs,
 		Environment:   buildConfig.Environment,
 		ProjectID:     deployment.ProjectID,
 		ServiceID:     deployment.ServiceID,
@@ -330,7 +339,9 @@ func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deplo
 		HealthPath:     cfg.HealthPath,
 		RestartPolicy:  cfg.RestartPolicy,
 		MemoryBytes:    cfg.Resources.MemoryBytes,
+		MemoryReserve:  cfg.Resources.MemoryReservation,
 		NanoCPUs:       cfg.Resources.CPUQuota,
+		CPUShares:      cfg.Resources.CPUShares,
 		Volumes:        cfg.VolumeMounts,
 		Domains:        cfg.Domains,
 		Maintenance:    cfg.Maintenance,