feat: Sandboxed function execution via FUNCTIONS_DRIVER=docker

Each invoke runs in an ephemeral locked-down container — no network,
read-only rootfs, 128MiB/0.5CPU/64-pid caps, non-root, cap-drop ALL.
Source travels as base64 in the container env and materializes in the
tmpfs, so no bind mount is needed (Docker Desktop / remote daemons work).
Timeout force-removes the named container.

exec driver stays the default; the trust-model docs now describe both.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -65,6 +65,16 @@ BACKEND_STORAGE_DRIVER=local
 # can't reach. Presigned URLs are valid only at the host they were minted for.
 #S3_PUBLIC_ENDPOINT=https://objects.example.com
 
+# Functions execution. "exec" runs the runtime binary (bun/deno) directly on
+# the backend host — simple, but function code inherits backend privileges.
+# "docker" runs each invoke in an ephemeral locked-down container (no
+# network, read-only fs, 128 MiB mem, non-root) and requires the Docker
+# socket mounted into the backend plus the runtime images pulled.
+#FUNCTIONS_DRIVER=exec
+#FUNCTIONS_RUNTIME=auto
+#FUNCTIONS_TIMEOUT_SECONDS=30
+#FUNCTIONS_MAX_OUTPUT_BYTES=65536
+
 # Mail defaults — each is overridable in-app (Settings → Instance). In-app
 # values win over these env vars; deleting the in-app value reverts here.
 RESEND_API_KEY=