feat(services): builder selection, resource reservations, static builder (C3)

services.builder picks the build strategy per service: auto detects from
repo contents (Dockerfile → railpack → nixpacks), explicit overrides force
a builder, and static builds assets in a node stage then serves them from
an nginx image (static_build_cmd/static_dir, port 80 default).

- cpu_reserve/memory_reserve → Docker CPU shares + MemoryReservation;
  cpu/memory stay hard caps (NanoCPUs/Memory). Empty string clears.
- app_settings.default_cpu/default_memory override service-create
  fallbacks; capacity_policy=block fails deploys whose requested memory
  exceeds node capacity (default warn logs via slog).
- Resource specs are validated — "512mb" fails instead of silently
  dropping the limit.
- Fixes: deployments.go hardcoded nixpacks (auto-detect was dead code);
  DockerfileBuilder passed the Dockerfile *path* as build-context content;
  BuildImage never drained the daemon stream so builds could abort and
  errors went unseen — stream is now consumed and errorDetail surfaced.
- CLI: --builder/--cpu-reserve/--memory-reserve/--static-cmd/--static-dir
  on create+update; MCP args on services create/update; UI Build &
  Resources card; OpenAPI + llms.txt + CLI.md.

Verified live: static build of a real repo → nginx image → deployed;
reserves reach HostConfig (shares=256, MemoryReservation=128Mi);
validation rejects bad specs; builder persists + clears.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/generated/api-types.ts

@@ -8050,6 +8050,19 @@ export interface components {
             maintenance_mode?: boolean;
             /** @description Basic-auth usernames gating the route (hashes never returned) */
             basic_auth?: string[];
+            /**
+             * @description Build strategy; auto detects from repo contents
+             * @enum {string}
+             */
+            builder?: "auto" | "railpack" | "nixpacks" | "dockerfile" | "static";
+            /** @description Soft CPU reservation (fraction, e.g. 0.25 → ~256 CPU shares) */
+            cpu_reserve?: string;
+            /** @description Soft memory reservation (e.g. 128Mi) */
+            memory_reserve?: string;
+            /** @description Build command for the static builder (default "npm ci && npm run build") */
+            static_build_cmd?: string;
+            /** @description Output directory for the static builder (default dist) */
+            static_dir?: string;
             /** @description Computed public URL (published port or domain) */
             public_url?: string;
             /**
@@ -8107,6 +8120,19 @@ export interface components {
             restart_policy?: string;
             /** @description Volume/bind mounts applied to every replica */
             volumes?: components["schemas"]["ServiceVolume"][];
+            /**
+             * @description Build strategy (default auto)
+             * @enum {string}
+             */
+            builder?: "auto" | "railpack" | "nixpacks" | "dockerfile" | "static";
+            /** @description Soft CPU reservation (fraction, e.g. 0.25) */
+            cpu_reserve?: string;
+            /** @description Soft memory reservation (e.g. 128Mi) */
+            memory_reserve?: string;
+            /** @description Build command for the static builder */
+            static_build_cmd?: string;
+            /** @description Output directory for the static builder (default dist) */
+            static_dir?: string;
         };
         UpdateServiceRequest: {
             /** @description Service name */
@@ -8151,6 +8177,19 @@ export interface components {
             maintenance_mode?: boolean;
             /** @description Replaces all basic-auth credentials; [] clears the gate */
             basic_auth?: components["schemas"]["BasicAuthCred"][];
+            /**
+             * @description Build strategy
+             * @enum {string}
+             */
+            builder?: "auto" | "railpack" | "nixpacks" | "dockerfile" | "static";
+            /** @description Soft CPU reservation (empty string clears) */
+            cpu_reserve?: string;
+            /** @description Soft memory reservation (empty string clears) */
+            memory_reserve?: string;
+            /** @description Build command for the static builder (empty string clears) */
+            static_build_cmd?: string;
+            /** @description Output directory for the static builder (empty string clears) */
+            static_dir?: string;
         };
         ServiceDomain: {
             /** Format: uuid */