right-size memory: set requests=limits based on actual usage

- Set memory requests = limits across 56 stacks to prevent overcommit
- Right-sized limits based on actual pod usage (2x actual, rounded up)
- Scaled down trading-bot (replicas=0) to free memory
- Fixed OOMKilled services: forgejo, dawarich, health, meshcentral,
  paperless-ngx, vault auto-unseal, rybbit, whisper, openclaw, clickhouse
- Added startup+liveness probes to calibre-web
- Bumped inotify limits on nodes 2,3 (max_user_instances 128->8192)

Post node2 OOM incident (2026-03-14). Previous kubelet config had no
kubeReserved/systemReserved set, allowing pods to starve the kernel.

stacks/vault/main.tf

@@ -130,8 +130,8 @@ resource "helm_release" "vault" {
           readOnly  = true
         }]
         resources = {
-          requests = { cpu = "10m", memory = "32Mi" }
-          limits   = { memory = "64Mi" }
+          requests = { cpu = "10m", memory = "128Mi" }
+          limits   = { memory = "128Mi" }
         }
       }]
     }