feat(services): sleep mode — scale-to-zero on idle, wake on traffic

Services gain sleep_enabled + sleep_idle_minutes. A 30s sweeper tracks
container NetworkIO deltas; a flat counter for the configured window
scales the service to zero (status=sleeping, workload containers removed).

While slept, a busybox wake container takes over the service's Traefik
host rule at priority 100: it serves a self-reloading "waking" page and
calls the unauthenticated idempotent GET/POST /api/v1/internal/wake/:id,
which reconciles the service back to running. Wake placeholders carry a
dedicated label (containr.wake-for) so runtime state never counts them;
the sweeper prunes them once the workload is up. The wake URL resolves
the API via its container name when containerized, else the edge
network's IPAM gateway — bare-metal installs need HOST=0.0.0.0 for the
callback.

Surfaces: PUT fields on services, POST /services/:id/sleep|wake,
CLI --sleep/--sleep-idle + services sleep|wake, 2 MCP tools (89 total),
OpenAPI paths/schema, and a Settings > Sleep card with toggle, idle
minutes, and manual sleep/wake plus a Sleeping badge.

Verified live: idle sweep scaled whoami-web to zero; the wake container
served the page on the edge network and its callback woke the service
(container recreated, status running, placeholder pruned).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/api/openapi.yaml

@@ -649,6 +649,60 @@ paths:
         '200':
           description: Service restarted
 
+  /services/{id}/sleep:
+    post:
+      tags:
+        - Services
+      summary: Sleep service
+      description: Scale the service to zero immediately. When it has public domains a wake placeholder holds the route and resumes the service on the next request.
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '202':
+          description: Sleep initiated
+
+  /services/{id}/wake:
+    post:
+      tags:
+        - Services
+      summary: Wake service
+      description: Reconcile a sleeping service back to running on demand
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '202':
+          description: Wake initiated
+
+  /internal/wake/{id}:
+    get:
+      tags:
+        - Services
+      summary: Wake callback (internal)
+      description: Unauthenticated wake endpoint hit by the busybox wake placeholder while a slept service resumes. Idempotent and non-destructive.
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '202':
+          description: Wake accepted
+        '404':
+          description: Service not found
+
   /services/{id}/redeploy:
     post:
       tags:
@@ -5763,6 +5817,12 @@ components:
         static_dir:
           type: string
           description: Output directory for the static builder (default dist)
+        sleep_enabled:
+          type: boolean
+          description: Scale to zero after sleep_idle_minutes without inbound traffic; a wake placeholder answers requests while the service resumes
+        sleep_idle_minutes:
+          type: integer
+          description: Idle timeout in minutes before sleeping (1-1440, default 15)
         public_url:
           type: string
           description: Computed public URL (published port or domain)
@@ -5934,6 +5994,12 @@ components:
         static_dir:
           type: string
           description: Output directory for the static builder (empty string clears)
+        sleep_enabled:
+          type: boolean
+          description: Scale to zero after sleep_idle_minutes without inbound traffic; a wake placeholder answers requests while resuming
+        sleep_idle_minutes:
+          type: integer
+          description: Idle timeout in minutes before sleeping (1-1440)
 
     ServiceDomain:
       type: object

docs/guides/CLI.md

@@ -159,6 +159,25 @@ instance-level defaults used at service creation;
 `app_settings.capacity_policy=block` fails deployments whose requested
 memory exceeds node capacity (default `warn` logs only).
 
+## Sleep mode (scale-to-zero)
+
+Services can scale to zero after an idle window and resume on traffic:
+
+```bash
+containr services update <id> --sleep --sleep-idle 15   # enable, 15 min idle timeout
+containr services update <id> --sleep=false            # disable
+containr services sleep <id>                           # sleep now
+containr services wake <id>                            # resume now
+```
+
+Idleness is measured as flat container network I/O over the configured
+window (swept every 30s). Sleeping removes the workload containers and —
+when the service has domains — installs a busybox placeholder that holds
+the Traefik route at higher priority, serves a reloading "waking" page,
+and pings `GET /api/v1/internal/wake/:id` to reconcile the service back.
+The API must be reachable from containers for the callback (containerized
+deploys work via the shared network; bare-metal needs `HOST=0.0.0.0`).
+
 ## Clone, move, registries
 
 `services clone` duplicates config, volumes, domains, access gates,