F1 (rework): source guest RAM cap from docker info; deploy guard uses committed memory

The cgroup-only approach was a no-op on the demo: the controller container's OWN
cgroup is unlimited (the 2GB cap is on the LXC ancestor, hidden), and /proc has no
lxcfs, so it kept reporting the host's 16GB. The Docker daemon runs IN the LXC, so
'docker info' MemTotal reports the guest's real cap (2048MB) — now the authoritative
source (cgroup limit preferred when present, e.g. non-nested). The deploy memory
guard now uses the controller's committed-app memory (sum of running mem requests)
for 'used' — accurate and cheap — instead of host /proc RSS (unobservable per guest;
would make the guard never/always fire). /api/system/info reports the guest cap as
total and committed memory as used. Tests: cgroup-limit path, docker-info fallback
(nested case), GuestMemTotalMB fallback (dockerMemTotalFn stub).

controller/internal/api/router.go

@@ -719,6 +719,20 @@ func (r *Router) triggerSync(w http.ResponseWriter, _ *http.Request) {
 
 func (r *Router) systemInfo(w http.ResponseWriter, _ *http.Request) {
 	info := system.GetInfo(r.cfg.Paths.HDDPath, r.cpuCollector)
+	// F1: GetInfo now reports the guest RAM cap (from the Docker daemon) as TotalMemMB, but the guest-wide
+	// "used" is not observable from the container. Report the controller's accurate committed-app memory
+	// (sum of running apps' mem requests) as used — a meaningful "allocated of cap" figure for the UI.
+	if r.stackMgr != nil && info.TotalMemMB > 0 {
+		if reqMB, _ := r.stackMgr.CommittedMemory(); reqMB >= 0 {
+			used := uint64(reqMB)
+			if used > info.TotalMemMB {
+				used = info.TotalMemMB
+			}
+			info.UsedMemMB = used
+			info.AvailMemMB = info.TotalMemMB - used
+			info.MemPercent = float64(used) / float64(info.TotalMemMB) * 100
+		}
+	}
 	syncStatus := r.syncer.Status()
 	data := map[string]interface{}{
 		"system":      info,