[ci skip] switch VPA to off mode globally, fix Ollama/MySQL resources

- Kyverno policy: VPA mode set to 'off' for all namespaces (was 'initial'
  for non-core). Terraform is now sole authority for container resources.
  Goldilocks provides recommendations only.
- Ollama: add explicit CPU/memory resources (500m/4Gi req, 4/12Gi limit)
  alongside GPU allocation. Fixes OOMKill from VPA scaling down resources.
- MySQL InnoDB Cluster: bump memory limit from 2Gi to 3Gi.
- Remove redundant per-namespace VPA opt-out labels from onlyoffice,
  openclaw, trading-bot (now handled globally by Kyverno policy).

stacks/platform/modules/dbaas/main.tf

@@ -150,7 +150,7 @@ resource "helm_release" "mysql_cluster" {
       }
       limits = {
         cpu    = "2"
-        memory = "2Gi"
+        memory = "3Gi"
       }
     }
 
@@ -176,7 +176,7 @@ resource "helm_release" "mysql_cluster" {
             cpu    = "250m"
           }
           limits = {
-            memory = "2Gi"
+            memory = "3Gi"
             cpu    = "2"
           }
         }