Add /system/standby API for out-of-band scale-to-zero pin

Adds two new endpoints to the kernel-images server:
- POST /system/standby/disable — pins scale-to-zero off until released
- POST /system/standby/enable  — releases the pin

The pin lives alongside the existing request-driven middleware refcount in
DebouncedController: scale-to-zero stays disabled while either holders are
inflight requests OR the pin is held. Request-driven Enable calls do not
release the pin, so a pinned VM survives idle periods. Releasing the pin
honors any configured re-enable cooldown.

This is the in-VM surface for future control-plane integrations (e.g. a
hot-pool controller reserving a VM until it is claimed). Control-plane
wiring will follow in metro-api and the API server.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: sjmiller609

server/cmd/api/api/api.go

@@ -49,7 +49,7 @@ type ApiService struct {
 
 	// DevTools upstream manager (Chromium supervisord log tailer)
 	upstreamMgr *devtoolsproxy.UpstreamManager
-	stz         scaletozero.Controller
+	stz         scaletozero.PinnedController
 
 	// inputMu serializes input-related operations (mouse, keyboard, screenshot)
 	inputMu sync.Mutex
@@ -96,7 +96,7 @@ func New(
 	recordManager recorder.RecordManager,
 	factory recorder.FFmpegRecorderFactory,
 	upstreamMgr *devtoolsproxy.UpstreamManager,
-	stz scaletozero.Controller,
+	stz scaletozero.PinnedController,
 	nekoAuthClient *nekoclient.AuthClient,
 	captureSession *capturesession.CaptureSession,
 	eventStream    *events.EventStream,

server/cmd/api/api/standby.go

@@ -0,0 +1,24 @@
+package api
+
+import (
+	"context"
+
+	"github.com/kernel/kernel-images/server/lib/logger"
+	oapi "github.com/kernel/kernel-images/server/lib/oapi"
+)
+
+func (s *ApiService) DisableStandby(ctx context.Context, _ oapi.DisableStandbyRequestObject) (oapi.DisableStandbyResponseObject, error) {
+	if err := s.stz.DisablePin(ctx); err != nil {
+		logger.FromContext(ctx).Error("failed to pin scale-to-zero disabled", "err", err)
+		return oapi.DisableStandby500JSONResponse{InternalErrorJSONResponse: oapi.InternalErrorJSONResponse{Message: "failed to disable standby"}}, nil
+	}
+	return oapi.DisableStandby204Response{}, nil
+}
+
+func (s *ApiService) EnableStandby(ctx context.Context, _ oapi.EnableStandbyRequestObject) (oapi.EnableStandbyResponseObject, error) {
+	if err := s.stz.EnablePin(ctx); err != nil {
+		logger.FromContext(ctx).Error("failed to release scale-to-zero pin", "err", err)
+		return oapi.EnableStandby500JSONResponse{InternalErrorJSONResponse: oapi.InternalErrorJSONResponse{Message: "failed to enable standby"}}, nil
+	}
+	return oapi.EnableStandby204Response{}, nil
+}