[ci skip] Fix whiteboard priority class mismatch and OnlyOffice OOMKill

- Add priority_class_name to nextcloud whiteboard deployment to match
  Kyverno-injected tier-3-edge priority class
- Add explicit resource limits (4Gi memory) for OnlyOffice document
  server to prevent OOMKill during font generation

modules/kubernetes/nextcloud/main.tf

@@ -72,6 +72,7 @@ resource "kubernetes_deployment" "whiteboard" {
         }
       }
       spec {
+        priority_class_name = "tier-3-edge"
         container {
           image = "ghcr.io/nextcloud-releases/whiteboard:release"
           name  = "whiteboard"

modules/kubernetes/onlyoffice/main.tf

@@ -8,6 +8,7 @@ resource "kubernetes_namespace" "onlyoffice" {
     name = "onlyoffice"
     labels = {
       "istio-injection" : "disabled"
+      tier = var.tier
     }
   }
 }
@@ -44,6 +45,16 @@ resource "kubernetes_deployment" "onlyoffice-document-server" {
         container {
           name  = "onlyoffice-document-server"
           image = "onlyoffice/documentserver:8.2.3"
+          resources {
+            requests = {
+              cpu    = "100m"
+              memory = "512Mi"
+            }
+            limits = {
+              cpu    = "2"
+              memory = "4Gi"
+            }
+          }
           port {
             name           = "http"
             container_port = 80