rightsize: raise OOM-tight memory limits (batch 3/N — spike protection)

shlink 512->704Mi, linkwarden 1Gi->1280Mi, chrome-service 2Gi->2624Mi, forgejo 4Gi->5Gi, f1-stream 256->384Mi. All were request==limit with 30d peak at 91-100% of the ceiling — a spike would OOM-kill them. Raising the limit (now Burstable, request<limit) gives real burst headroom. This is the genuine 'don't OOM on occasional spike' fix. Small add (~2.2Gi limits) vs the ~20Gi of fat removed in batches 1-2, so net overcommit keeps dropping.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/chrome-service/main.tf

@@ -321,7 +321,7 @@ resource "kubernetes_deployment" "chrome_service" {
               memory = "1500Mi"
             }
             limits = {
-              memory = "2Gi"
+              memory = "2624Mi"
             }
           }
         }