feat: CPU/RAM limits per stage, NPM access list (global + per-project)

Resource limits:
- Add cpu_limit (cores) and memory_limit (MB) fields to Stage model
- Pass limits to Docker container via NanoCPUs and Memory in HostConfig
- Add CPU/Memory fields to stage creation form in project detail
- 0 = unlimited (default)

NPM access list:
- Add npm_access_list_id to Settings (global default) and Project (per-project override)
- Per-project overrides global when > 0
- NPM provider passes access_list_id when configuring proxy hosts
- Add GET /api/settings/npm-access-lists endpoint to list NPM access lists
- Add access list picker on NPM settings page (global)
- Add access list ID field on project edit form (per-project)
- DB migrations for all new columns

internal/store/models.go

@@ -8,10 +8,11 @@ type Project struct {
 	Image       string `json:"image"`
 	Port        int    `json:"port"`
 	Healthcheck string `json:"healthcheck"`
-	Env         string `json:"env"`     // JSON-encoded map
-	Volumes     string `json:"volumes"` // JSON-encoded map
-	CreatedAt   string `json:"created_at"`
-	UpdatedAt   string `json:"updated_at"`
+	Env              string `json:"env"`     // JSON-encoded map
+	Volumes          string `json:"volumes"` // JSON-encoded map
+	NpmAccessListID  int    `json:"npm_access_list_id"` // per-project override, 0 = use global
+	CreatedAt        string `json:"created_at"`
+	UpdatedAt        string `json:"updated_at"`
 }
 
 // Stage represents a deployment stage within a project (e.g. dev, rel, prod).
@@ -23,10 +24,12 @@ type Stage struct {
 	AutoDeploy   bool   `json:"auto_deploy"`
 	MaxInstances int    `json:"max_instances"`
 	Confirm      bool   `json:"confirm"`
-	EnableProxy  bool   `json:"enable_proxy"`
-	PromoteFrom  string `json:"promote_from"`
-	Subdomain       string `json:"subdomain"`
-	NotificationURL string `json:"notification_url"`
+	EnableProxy  bool    `json:"enable_proxy"`
+	PromoteFrom  string  `json:"promote_from"`
+	Subdomain       string  `json:"subdomain"`
+	NotificationURL string  `json:"notification_url"`
+	CpuLimit        float64 `json:"cpu_limit"`    // CPU cores (e.g., 0.5, 1, 2), 0 = unlimited
+	MemoryLimit     int     `json:"memory_limit"` // megabytes, 0 = unlimited
 	CreatedAt       string `json:"created_at"`
 	UpdatedAt       string `json:"updated_at"`
 }
@@ -64,6 +67,7 @@ type Settings struct {
 	CloudflareAPIToken   string `json:"cloudflare_api_token"`
 	CloudflareZoneID     string `json:"cloudflare_zone_id"`
 	NpmRemote           bool   `json:"npm_remote"`
+	NpmAccessListID     int    `json:"npm_access_list_id"`
 	ProxyProvider       string `json:"proxy_provider"`
 	TraefikEntrypoint   string `json:"traefik_entrypoint"`
 	TraefikCertResolver string `json:"traefik_cert_resolver"`