right-size memory: set requests=limits based on actual usage

- Set memory requests = limits across 56 stacks to prevent overcommit
- Right-sized limits based on actual pod usage (2x actual, rounded up)
- Scaled down trading-bot (replicas=0) to free memory
- Fixed OOMKilled services: forgejo, dawarich, health, meshcentral,
  paperless-ngx, vault auto-unseal, rybbit, whisper, openclaw, clickhouse
- Added startup+liveness probes to calibre-web
- Bumped inotify limits on nodes 2,3 (max_user_instances 128->8192)

Post node2 OOM incident (2026-03-14). Previous kubelet config had no
kubeReserved/systemReserved set, allowing pods to starve the kernel.

stacks/webhook_handler/main.tf

@@ -110,11 +110,11 @@ resource "kubernetes_deployment" "webhook_handler" {
           name  = "webhook-handler"
           resources {
             limits = {
-              memory = "256Mi"
+              memory = "64Mi"
             }
             requests = {
               cpu    = "10m"
-              memory = "32Mi"
+              memory = "64Mi"
             }
           }
           port {