Add skip_pre_post build option, cancel endpoint, and recipe package

- skip_pre_post flag on builds bypasses apt update/clean pre/post steps for
  faster iteration when the recipe handles its own environment setup
- POST /v1/admin/builds/{id}/cancel endpoint marks an in-progress build as
  cancelled; UpdateBuildStatus now also sets completed_at for 'cancelled'
- internal/recipe: typed recipe parser and executor (RUN/ENV/COPY steps)
  replacing the raw string slice approach in the build worker
- pre/post build commands prefixed with RUN to match recipe step format

internal/api/handlers_builds.go

@@ -36,6 +36,7 @@ type createBuildRequest struct {
 	Healthcheck  string   `json:"healthcheck"`
 	VCPUs        int32    `json:"vcpus"`
 	MemoryMB     int32    `json:"memory_mb"`
+	SkipPrePost  bool     `json:"skip_pre_post"`
 }
 
 type buildResponse struct {
@@ -127,6 +128,7 @@ func (h *buildHandler) Create(w http.ResponseWriter, r *http.Request) {
 		Healthcheck:  req.Healthcheck,
 		VCPUs:        req.VCPUs,
 		MemoryMB:     req.MemoryMB,
+		SkipPrePost:  req.SkipPrePost,
 	})
 	if err != nil {
 		slog.Error("failed to create build", "error", err)
@@ -254,3 +256,21 @@ func (h *buildHandler) DeleteTemplate(w http.ResponseWriter, r *http.Request) {
 
 	w.WriteHeader(http.StatusNoContent)
 }
+
+// Cancel handles POST /v1/admin/builds/{id}/cancel.
+func (h *buildHandler) Cancel(w http.ResponseWriter, r *http.Request) {
+	buildIDStr := chi.URLParam(r, "id")
+
+	buildID, err := id.ParseBuildID(buildIDStr)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_request", "invalid build ID")
+		return
+	}
+
+	if err := h.svc.Cancel(r.Context(), buildID); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_request", err.Error())
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}