feat: NPM access list support (global default + per-project override)

internal/store/store.go

@@ -113,6 +113,12 @@ func (s *Store) runMigrations() error {
 		`UPDATE settings SET network = 'docker-watcher' WHERE network = ''`,
 		// NPM remote mode: forward to server_ip instead of container name.
 		`ALTER TABLE settings ADD COLUMN npm_remote INTEGER NOT NULL DEFAULT 0`,
+		// Resource limits per stage.
+		`ALTER TABLE stages ADD COLUMN cpu_limit REAL NOT NULL DEFAULT 0`,
+		`ALTER TABLE stages ADD COLUMN memory_limit INTEGER NOT NULL DEFAULT 0`,
+		// NPM access list support (global default + per-project override).
+		`ALTER TABLE settings ADD COLUMN npm_access_list_id INTEGER NOT NULL DEFAULT 0`,
+		`ALTER TABLE projects ADD COLUMN npm_access_list_id INTEGER NOT NULL DEFAULT 0`,
 	}
 
 	for _, m := range migrations {
@@ -167,6 +173,7 @@ CREATE TABLE IF NOT EXISTS projects (
 	healthcheck TEXT NOT NULL DEFAULT '',
 	env        TEXT NOT NULL DEFAULT '{}',
 	volumes    TEXT NOT NULL DEFAULT '{}',
+	npm_access_list_id INTEGER NOT NULL DEFAULT 0,
 	created_at TEXT NOT NULL DEFAULT (datetime('now')),
 	updated_at TEXT NOT NULL DEFAULT (datetime('now'))
 );
@@ -183,6 +190,8 @@ CREATE TABLE IF NOT EXISTS stages (
 	promote_from  TEXT NOT NULL DEFAULT '',
 	subdomain         TEXT NOT NULL DEFAULT '',
 	notification_url  TEXT NOT NULL DEFAULT '',
+	cpu_limit         REAL NOT NULL DEFAULT 0,
+	memory_limit      INTEGER NOT NULL DEFAULT 0,
 	created_at    TEXT NOT NULL DEFAULT (datetime('now')),
 	updated_at    TEXT NOT NULL DEFAULT (datetime('now')),
 	UNIQUE(project_id, name)
@@ -213,6 +222,7 @@ CREATE TABLE IF NOT EXISTS settings (
 	base_volume_path   TEXT NOT NULL DEFAULT '',
 	ssl_certificate_id     INTEGER NOT NULL DEFAULT 0,
 	npm_remote             INTEGER NOT NULL DEFAULT 0,
+	npm_access_list_id     INTEGER NOT NULL DEFAULT 0,
 	traefik_entrypoint     TEXT NOT NULL DEFAULT 'websecure',
 	traefik_cert_resolver  TEXT NOT NULL DEFAULT 'letsencrypt',
 	traefik_network        TEXT NOT NULL DEFAULT '',