feat(services): sleep mode — scale-to-zero on idle, wake on traffic

Services gain sleep_enabled + sleep_idle_minutes. A 30s sweeper tracks
container NetworkIO deltas; a flat counter for the configured window
scales the service to zero (status=sleeping, workload containers removed).

While slept, a busybox wake container takes over the service's Traefik
host rule at priority 100: it serves a self-reloading "waking" page and
calls the unauthenticated idempotent GET/POST /api/v1/internal/wake/:id,
which reconciles the service back to running. Wake placeholders carry a
dedicated label (containr.wake-for) so runtime state never counts them;
the sweeper prunes them once the workload is up. The wake URL resolves
the API via its container name when containerized, else the edge
network's IPAM gateway — bare-metal installs need HOST=0.0.0.0 for the
callback.

Surfaces: PUT fields on services, POST /services/:id/sleep|wake,
CLI --sleep/--sleep-idle + services sleep|wake, 2 MCP tools (89 total),
OpenAPI paths/schema, and a Settings > Sleep card with toggle, idle
minutes, and manual sleep/wake plus a Sleeping badge.

Verified live: idle sweep scaled whoami-web to zero; the wake container
served the page on the edge network and its callback woke the service
(container recreated, status running, placeholder pruned).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/guides/CLI.md

@@ -159,6 +159,25 @@ instance-level defaults used at service creation;
 `app_settings.capacity_policy=block` fails deployments whose requested
 memory exceeds node capacity (default `warn` logs only).
 
+## Sleep mode (scale-to-zero)
+
+Services can scale to zero after an idle window and resume on traffic:
+
+```bash
+containr services update <id> --sleep --sleep-idle 15   # enable, 15 min idle timeout
+containr services update <id> --sleep=false            # disable
+containr services sleep <id>                           # sleep now
+containr services wake <id>                            # resume now
+```
+
+Idleness is measured as flat container network I/O over the configured
+window (swept every 30s). Sleeping removes the workload containers and —
+when the service has domains — installs a busybox placeholder that holds
+the Traefik route at higher priority, serves a reloading "waking" page,
+and pings `GET /api/v1/internal/wake/:id` to reconcile the service back.
+The API must be reachable from containers for the callback (containerized
+deploys work via the shared network; bare-metal needs `HOST=0.0.0.0`).
+
 ## Clone, move, registries
 
 `services clone` duplicates config, volumes, domains, access gates,