[ci skip] right-size all pod resources based on VPA + live metrics audit

Full cluster resource audit: cross-referenced Goldilocks VPA recommendations,
live kubectl top metrics, and Terraform definitions for 100+ containers.

Critical fixes:
- dashy: CPU throttled at 98% (490m/500m) → 2 CPU limit
- stirling-pdf: CPU throttled at 99.7% (299m/300m) → 2 CPU limit
- traefik auth-proxy/bot-block-proxy: mem limit 32Mi → 128Mi

Added explicit resources to ~40 containers that had none:
- audiobookshelf, changedetection, cyberchef, dawarich, diun, echo,
  excalidraw, freshrss, hackmd, isponsorblocktv, linkwarden, n8n,
  navidrome, ntfy, owntracks, privatebin, send, shadowsocks, tandoor,
  tor-proxy, wealthfolio, networking-toolbox, rybbit, mailserver,
  cloudflared, pgadmin, phpmyadmin, crowdsec-web, xray, wireguard,
  k8s-portal, tuya-bridge, ollama-ui, whisper, piper, immich-server,
  immich-postgresql, osrm-foot

GPU containers: added CPU/mem alongside GPU limits:
- ollama: removed CPU/mem limits (models vary in size), keep GPU only
- frigate: req 500m/2Gi, lim 4/8Gi + GPU
- immich-ml: req 100m/1Gi, lim 2/4Gi + GPU

Right-sized ~25 over-provisioned containers:
- kms-web-page: 500m/512Mi → 50m/64Mi (was using 0m/10Mi)
- onlyoffice: CPU 8 → 2 (VPA upper 45m)
- realestate-crawler-api: CPU 2000m → 250m
- blog/travel-blog/webhook-handler: 500m → 100m
- coturn/health/plotting-book: reduced to match actual usage

Conservative methodology: limits = max(VPA upper * 2, live usage * 2)

stacks/platform/modules/dbaas/main.tf

@@ -221,8 +221,8 @@ resource "kubernetes_service" "mysql" {
   spec {
     publish_not_ready_addresses = true # bypass InnoDB Cluster readiness gate during partial failures
     selector = {
-      "component"                    = "mysqld"
-      "mysql.oracle.com/cluster"     = "mysql-cluster"
+      "component"                     = "mysqld"
+      "mysql.oracle.com/cluster"      = "mysql-cluster"
       "mysql.oracle.com/cluster-role" = "PRIMARY"
     }
     port {
@@ -477,6 +477,16 @@ resource "kubernetes_deployment" "phpmyadmin" {
             name  = "UPLOAD_LIMIT"
             value = "300M"
           }
+          resources {
+            requests = {
+              cpu    = "15m"
+              memory = "32Mi"
+            }
+            limits = {
+              cpu    = "250m"
+              memory = "256Mi"
+            }
+          }
         }
         dns_config {
           option {
@@ -763,12 +773,12 @@ module "ingress" {
 # Ensure the CNPG cluster manifest exists (idempotent kubectl apply)
 resource "null_resource" "pg_cluster" {
   triggers = {
-    instances      = "2"
-    image          = "ghcr.io/cloudnative-pg/postgis:16"
-    storage_size   = "20Gi"
-    storage_class  = "local-path"
-    memory_limit   = "4Gi"
-    cpu_limit      = "2"
+    instances     = "2"
+    image         = "ghcr.io/cloudnative-pg/postgis:16"
+    storage_size  = "20Gi"
+    storage_class = "local-path"
+    memory_limit  = "4Gi"
+    cpu_limit     = "2"
   }
 
   provisioner "local-exec" {
@@ -900,6 +910,17 @@ resource "kubernetes_deployment" "pgadmin" {
             mount_path = "/var/lib/pgadmin/"
           }
 
+          resources {
+            requests = {
+              cpu    = "25m"
+              memory = "128Mi"
+            }
+            limits = {
+              cpu    = "500m"
+              memory = "512Mi"
+            }
+          }
+
         }
         volume {
           name = "pgadmin"