[ci skip] switch VPA to off mode globally, fix Ollama/MySQL resources

- Kyverno policy: VPA mode set to 'off' for all namespaces (was 'initial'
  for non-core). Terraform is now sole authority for container resources.
  Goldilocks provides recommendations only.
- Ollama: add explicit CPU/memory resources (500m/4Gi req, 4/12Gi limit)
  alongside GPU allocation. Fixes OOMKill from VPA scaling down resources.
- MySQL InnoDB Cluster: bump memory limit from 2Gi to 3Gi.
- Remove redundant per-namespace VPA opt-out labels from onlyoffice,
  openclaw, trading-bot (now handled globally by Kyverno policy).

stacks/ollama/main.tf

@@ -121,7 +121,13 @@ resource "kubernetes_deployment" "ollama" {
             mount_path = "/root/.ollama"
           }
           resources {
+            requests = {
+              cpu    = "500m"
+              memory = "4Gi"
+            }
             limits = {
+              cpu              = "4"
+              memory           = "12Gi"
               "nvidia.com/gpu" = "1"
             }
           }