fix: eliminate memory overcommit to prevent node OOM crashes

Set requests = limits (Guaranteed QoS) across LimitRange defaults and
explicit pod resources. Node2 crashed 2026-03-14 from 250% memory
overcommit (61GB limits on 24GB node).

Changes:
- LimitRange: default = defaultRequest for all 6 tiers
- Grafana: 3 → 2 replicas
- Grampsweb: document why replicas=0
- Prometheus: 1Gi/4Gi → 3Gi/3Gi
- OpenClaw: 512Mi/2Gi → 768Mi/768Mi
- Immich server: 256Mi/2Gi → 512Mi/512Mi
- Immich postgresql: 256Mi/1Gi → 512Mi/512Mi
- Calibre: 256Mi/1536Mi → 256Mi/256Mi
- Linkwarden: 256Mi/1536Mi → 768Mi/768Mi
- N8N: 256Mi/1Gi → 512Mi/512Mi
- MySQL cluster: 1Gi/3-4Gi → 2Gi/2Gi
- pg-cluster (CNPG): 512Mi/4Gi → 512Mi/512Mi
- DBaaS ResourceQuota limits.memory: 64Gi → 12Gi

[ci skip]

stacks/openclaw/main.tf

@@ -38,6 +38,10 @@ variable "forgejo_api_token" {
   type      = string
   sensitive = true
 }
+variable "claude_memory_api_key" {
+  type      = string
+  sensitive = true
+}
 variable "nfs_server" { type = string }
 
 
@@ -172,6 +176,15 @@ resource "kubernetes_config_map" "openclaw_config" {
           }
         }
       }
+      plugins = {
+        allow = ["memory-api"]
+        slots = {
+          memory = "memory-api"
+        }
+        load = {
+          paths = ["/home/node/.openclaw/extensions"]
+        }
+      }
       commands = {
         native       = true
         nativeSkills = true
@@ -442,6 +455,17 @@ resource "kubernetes_deployment" "openclaw" {
               done
             fi
 
+            # Install memory-api plugin from GitHub (always pull latest)
+            if [ -d /openclaw-home/extensions/memory-api/.git ]; then
+              (cd /openclaw-home/extensions/memory-api && git pull --ff-only) || true
+            else
+              rm -rf /openclaw-home/extensions/memory-api
+              git clone --depth 1 git@github.com:ViktorBarzin/claude-memory-mcp.git /tmp/claude-memory-mcp
+              mkdir -p /openclaw-home/extensions/memory-api
+              cp -r /tmp/claude-memory-mcp/openclaw-plugin/* /openclaw-home/extensions/memory-api/
+              rm -rf /tmp/claude-memory-mcp
+            fi
+
             # Create required directories (owned by node user, UID 1000)
             mkdir -p /openclaw-home/agents/main/sessions /openclaw-home/credentials /openclaw-home/canvas /openclaw-home/devices /openclaw-home/cron /openclaw-home/cc-skills /openclaw-home/memory
             chown -R 1000:1000 /openclaw-home
@@ -570,6 +594,15 @@ resource "kubernetes_deployment" "openclaw" {
             name  = "SLACK_WEBHOOK_URL"
             value = var.openclaw_skill_secrets["slack_webhook"]
           }
+          # Memory API
+          env {
+            name  = "MEMORY_API_URL"
+            value = "http://claude-memory.claude-memory.svc.cluster.local"
+          }
+          env {
+            name  = "MEMORY_API_KEY"
+            value = var.claude_memory_api_key
+          }
           # Python packages path for skills
           env {
             name  = "PYTHONPATH"
@@ -597,11 +630,11 @@ resource "kubernetes_deployment" "openclaw" {
           }
           resources {
             limits = {
-              memory = "2Gi"
+              memory = "768Mi"
             }
             requests = {
               cpu    = "100m"
-              memory = "512Mi"
+              memory = "768Mi"
             }
           }
         }