[ci skip] right-size all pod resources based on VPA + live metrics audit

Full cluster resource audit: cross-referenced Goldilocks VPA recommendations,
live kubectl top metrics, and Terraform definitions for 100+ containers.

Critical fixes:
- dashy: CPU throttled at 98% (490m/500m) → 2 CPU limit
- stirling-pdf: CPU throttled at 99.7% (299m/300m) → 2 CPU limit
- traefik auth-proxy/bot-block-proxy: mem limit 32Mi → 128Mi

Added explicit resources to ~40 containers that had none:
- audiobookshelf, changedetection, cyberchef, dawarich, diun, echo,
  excalidraw, freshrss, hackmd, isponsorblocktv, linkwarden, n8n,
  navidrome, ntfy, owntracks, privatebin, send, shadowsocks, tandoor,
  tor-proxy, wealthfolio, networking-toolbox, rybbit, mailserver,
  cloudflared, pgadmin, phpmyadmin, crowdsec-web, xray, wireguard,
  k8s-portal, tuya-bridge, ollama-ui, whisper, piper, immich-server,
  immich-postgresql, osrm-foot

GPU containers: added CPU/mem alongside GPU limits:
- ollama: removed CPU/mem limits (models vary in size), keep GPU only
- frigate: req 500m/2Gi, lim 4/8Gi + GPU
- immich-ml: req 100m/1Gi, lim 2/4Gi + GPU

Right-sized ~25 over-provisioned containers:
- kms-web-page: 500m/512Mi → 50m/64Mi (was using 0m/10Mi)
- onlyoffice: CPU 8 → 2 (VPA upper 45m)
- realestate-crawler-api: CPU 2000m → 250m
- blog/travel-blog/webhook-handler: 500m → 100m
- coturn/health/plotting-book: reduced to match actual usage

Conservative methodology: limits = max(VPA upper * 2, live usage * 2)

stacks/rybbit/main.tf

@@ -30,6 +30,28 @@ locals {
 }
 
 
+resource "kubernetes_config_map" "clickhouse_config" {
+  metadata {
+    name      = "clickhouse-config"
+    namespace = kubernetes_namespace.rybbit.metadata[0].name
+  }
+  data = {
+    "docker_related_config.xml" = <<-XML
+      <clickhouse>
+        <listen_host>::</listen_host>
+        <listen_host>0.0.0.0</listen_host>
+        <listen_try>1</listen_try>
+      </clickhouse>
+    XML
+    "disable-system-logs.xml"   = <<-XML
+      <clickhouse>
+        <background_pool_size>4</background_pool_size>
+        <background_schedule_pool_size>16</background_schedule_pool_size>
+      </clickhouse>
+    XML
+  }
+}
+
 resource "kubernetes_deployment" "clickhouse" {
   metadata {
     name      = "clickhouse"
@@ -60,10 +82,6 @@ resource "kubernetes_deployment" "clickhouse" {
             name  = "CLICKHOUSE_DB"
             value = local.clickhouse_db
           }
-          # env {
-          #   name  = "CLICKHOUSE_USER"
-          #   value = "clickhouse"
-          # }
           env {
             name  = "CLICKHOUSE_PASSWORD"
             value = var.clickhouse_password
@@ -77,6 +95,12 @@ resource "kubernetes_deployment" "clickhouse" {
             name       = "data"
             mount_path = "/var/lib/clickhouse"
           }
+          volume_mount {
+            name       = "config"
+            mount_path = "/etc/clickhouse-server/config.d/zzz-custom.xml"
+            sub_path   = "disable-system-logs.xml"
+            read_only  = true
+          }
           resources {
             requests = {
               cpu    = "100m"
@@ -95,6 +119,12 @@ resource "kubernetes_deployment" "clickhouse" {
             server = var.nfs_server
           }
         }
+        volume {
+          name = "config"
+          config_map {
+            name = kubernetes_config_map.clickhouse_config.metadata[0].name
+          }
+        }
       }
     }
   }
@@ -208,6 +238,16 @@ resource "kubernetes_deployment" "rybbit" {
           port {
             container_port = 3001
           }
+          resources {
+            requests = {
+              cpu    = "25m"
+              memory = "128Mi"
+            }
+            limits = {
+              cpu    = "250m"
+              memory = "512Mi"
+            }
+          }
         }
       }
     }
@@ -274,6 +314,16 @@ resource "kubernetes_deployment" "rybbit-client" {
             protocol       = "TCP"
             container_port = 3002
           }
+          resources {
+            requests = {
+              cpu    = "10m"
+              memory = "64Mi"
+            }
+            limits = {
+              cpu    = "150m"
+              memory = "256Mi"
+            }
+          }
         }
       }
     }