Remove all CPU limits cluster-wide to eliminate CFS throttling

CPU limits cause CFS throttling even when nodes have idle capacity.
Move to a request-only CPU model: keep CPU requests for scheduling
fairness but remove all CPU limits. Memory limits stay (incompressible).

Changes across 108 files:
- Kyverno LimitRange policy: remove cpu from default/max in all 6 tiers
- Kyverno ResourceQuota policy: remove limits.cpu from all 5 tiers
- Custom ResourceQuotas: remove limits.cpu from 8 namespace quotas
- Custom LimitRanges: remove cpu from default/max (nextcloud, onlyoffice)
- RBAC module: remove cpu_limits variable and quota reference
- Freedify factory: remove cpu_limit variable and limits reference
- 86 deployment files: remove cpu from all limits blocks
- 6 Helm values files: remove cpu under limits sections

stacks/servarr/aiostreams/main.tf

@@ -75,7 +75,6 @@ resource "kubernetes_deployment" "aiostreams" {
               memory = "256Mi"
             }
             limits = {
-              cpu    = "500m"
               memory = "1Gi"
             }
           }

stacks/servarr/flaresolverr/main.tf

@@ -37,7 +37,6 @@ resource "kubernetes_deployment" "flaresolverr" {
               memory = "150Mi"
             }
             limits = {
-              cpu    = "500m"
               memory = "384Mi"
             }
           }

stacks/servarr/listenarr/main.tf

@@ -62,7 +62,6 @@ resource "kubernetes_deployment" "listenarr" {
               memory = "256Mi"
             }
             limits = {
-              cpu    = "1"
               memory = "1Gi"
             }
           }

stacks/servarr/main.tf

@@ -1,5 +1,5 @@
 variable "tls_secret_name" {
-  type = string
+  type      = string
   sensitive = true
 }
 variable "aiostreams_database_connection_string" { type = string }

stacks/servarr/prowlarr/main.tf

@@ -59,7 +59,6 @@ resource "kubernetes_deployment" "prowlarr" {
               memory = "192Mi"
             }
             limits = {
-              cpu    = "500m"
               memory = "384Mi"
             }
           }

stacks/servarr/qbittorrent/main.tf

@@ -160,15 +160,15 @@ module "ingress" {
   tls_secret_name = var.tls_secret_name
   protected       = true
   extra_annotations = {
-    "gethomepage.dev/enabled"          = "true"
-    "gethomepage.dev/name"             = "qBittorrent"
-    "gethomepage.dev/description"      = "BitTorrent client"
-    "gethomepage.dev/icon"             = "qbittorrent.png"
-    "gethomepage.dev/group"            = "Media & Entertainment"
-    "gethomepage.dev/pod-selector"     = ""
-    "gethomepage.dev/widget.type"      = "qbittorrent"
-    "gethomepage.dev/widget.url"       = "http://qbittorrent.servarr.svc.cluster.local"
-    "gethomepage.dev/widget.username"  = var.homepage_credentials["qbittorrent"]["username"]
-    "gethomepage.dev/widget.password"  = var.homepage_credentials["qbittorrent"]["password"]
+    "gethomepage.dev/enabled"         = "true"
+    "gethomepage.dev/name"            = "qBittorrent"
+    "gethomepage.dev/description"     = "BitTorrent client"
+    "gethomepage.dev/icon"            = "qbittorrent.png"
+    "gethomepage.dev/group"           = "Media & Entertainment"
+    "gethomepage.dev/pod-selector"    = ""
+    "gethomepage.dev/widget.type"     = "qbittorrent"
+    "gethomepage.dev/widget.url"      = "http://qbittorrent.servarr.svc.cluster.local"
+    "gethomepage.dev/widget.username" = var.homepage_credentials["qbittorrent"]["username"]
+    "gethomepage.dev/widget.password" = var.homepage_credentials["qbittorrent"]["password"]
   }
 }