Two things ResourceSpec could not express: plan-time checks that span several attributes, and create bodies that need a key Dokploy insists on receiving but the model cannot produce. Both are used by the commits that follow.
