fix: openclaw policy violation + reduce memory requests for capacity

- openclaw: fix Kyverno policy violation (node:22-alpine ->
  docker.io/library/node:22-alpine), reduce request to 1536Mi
  with 2Gi limit for overcommit
- rybbit/clickhouse: reduce 1Gi -> 768Mi (frees 256Mi)
- stirling-pdf: reduce 1536Mi -> 1200Mi (frees 336Mi)

stacks/openclaw/main.tf

@@ -426,7 +426,7 @@ resource "kubernetes_deployment" "openclaw" {
             }
             requests = {
               cpu    = "100m"
-              memory = "2Gi"
+              memory = "1536Mi"
             }
           }
         }
@@ -434,7 +434,7 @@ resource "kubernetes_deployment" "openclaw" {
         # Sidecar: modelrelay — auto-routes to fastest healthy free model
         container {
           name  = "modelrelay"
-          image = "node:22-alpine"
+          image = "docker.io/library/node:22-alpine"
           command = ["sh", "-c", <<-EOF
             if [ ! -f /tools/modelrelay/node_modules/.package-lock.json ]; then
               mkdir -p /tools/modelrelay

stacks/rybbit/main.tf

@@ -302,10 +302,10 @@ resource "kubernetes_deployment" "rybbit" {
           resources {
             requests = {
               cpu    = "25m"
-              memory = "1Gi"
+              memory = "768Mi"
             }
             limits = {
-              memory = "1Gi"
+              memory = "768Mi"
             }
           }
         }

stacks/stirling-pdf/main.tf

@@ -58,10 +58,10 @@ resource "kubernetes_deployment" "stirling-pdf" {
           resources {
             requests = {
               cpu    = "25m"
-              memory = "1536Mi"
+              memory = "1200Mi"
             }
             limits = {
-              memory = "1536Mi"
+              memory = "1200Mi"
             }
           }