feat: CPU/RAM limits per stage, NPM access list (global + per-project)

Resource limits:
- Add cpu_limit (cores) and memory_limit (MB) fields to Stage model
- Pass limits to Docker container via NanoCPUs and Memory in HostConfig
- Add CPU/Memory fields to stage creation form in project detail
- 0 = unlimited (default)

NPM access list:
- Add npm_access_list_id to Settings (global default) and Project (per-project override)
- Per-project overrides global when > 0
- NPM provider passes access_list_id when configuring proxy hosts
- Add GET /api/settings/npm-access-lists endpoint to list NPM access lists
- Add access list picker on NPM settings page (global)
- Add access list ID field on project edit form (per-project)
- DB migrations for all new columns

internal/proxy/npm_provider.go

@@ -58,6 +58,7 @@ func (p *NpmProvider) ConfigureRoute(ctx context.Context, domain, targetHost str
 		BlockExploits:  true,
 		AllowWebsocket: true,
 		HTTP2Support:   true,
+		AccessListID:   opts.AccessListID,
 		Meta:           npm.Meta{},
 		Locations:      []any{},
 	}

internal/proxy/provider.go

@@ -5,6 +5,7 @@ import "context"
 // RouteOptions holds optional configuration for a proxy route.
 type RouteOptions struct {
 	SSLCertificateID int
+	AccessListID     int    // NPM access list ID for authentication, 0 = public
 	ForwardScheme    string // "http" or "https", defaults to "http"
 }