feat: CPU/RAM limits per stage, NPM access list (global + per-project)

Resource limits:
- Add cpu_limit (cores) and memory_limit (MB) fields to Stage model
- Pass limits to Docker container via NanoCPUs and Memory in HostConfig
- Add CPU/Memory fields to stage creation form in project detail
- 0 = unlimited (default)

NPM access list:
- Add npm_access_list_id to Settings (global default) and Project (per-project override)
- Per-project overrides global when > 0
- NPM provider passes access_list_id when configuring proxy hosts
- Add GET /api/settings/npm-access-lists endpoint to list NPM access lists
- Add access list picker on NPM settings page (global)
- Add access list ID field on project edit form (per-project)
- DB migrations for all new columns

web/src/lib/i18n/en.json

@@ -103,6 +103,12 @@
     "maxInstances": "Max Instances",
     "autoDeployLabel": "Auto Deploy",
     "enableProxy": "Enable Proxy",
+    "accessListId": "NPM Access List ID",
+    "accessListIdHelp": "Per-project override. 0 = use global default from NPM settings.",
+    "cpuLimit": "CPU Limit (cores)",
+    "cpuLimitHelp": "e.g., 0.5, 1, 2. Leave 0 for unlimited",
+    "memoryLimit": "Memory Limit (MB)",
+    "memoryLimitHelp": "e.g., 256, 512, 1024. Leave 0 for unlimited",
     "npmProxy": "NPM Proxy",
     "creating": "Creating...",
     "createStage": "Create Stage",
@@ -376,7 +382,13 @@
     "saveFailedConnection": "Cannot save \u2014 connection test failed",
     "remoteMode": "Remote NPM",
     "remoteModeHelp": "Enable when NPM runs on a different machine than Docker. Forwards to Server IP with published host ports.",
-    "remoteModeWarning": "Requires Server IP in General settings. Ports are auto-mapped to random host ports."
+    "remoteModeWarning": "Requires Server IP in General settings. Ports are auto-mapped to random host ports.",
+    "accessList": "Default Access List",
+    "accessListHelp": "NPM access list for HTTP authentication on proxy hosts. Can be overridden per project.",
+    "noAccessList": "None (public)",
+    "selectAccessList": "Select an access list",
+    "noAccessLists": "No access lists found in NPM",
+    "accessListLoadFailed": "Failed to load access lists"
   },
   "settingsCredentials": {
     "title": "Credentials",