rightsize: raise OOM-tight memory limits (batch 3/N — spike protection)

shlink 512->704Mi, linkwarden 1Gi->1280Mi, chrome-service 2Gi->2624Mi, forgejo 4Gi->5Gi, f1-stream 256->384Mi. All were request==limit with 30d peak at 91-100% of the ceiling — a spike would OOM-kill them. Raising the limit (now Burstable, request<limit) gives real burst headroom. This is the genuine 'don't OOM on occasional spike' fix. Small add (~2.2Gi limits) vs the ~20Gi of fat removed in batches 1-2, so net overcommit keeps dropping.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/f1-stream/main.tf

@@ -143,7 +143,7 @@ resource "kubernetes_deployment" "f1-stream" {
           # 256Mi = upperBound x ~1.3 (bursty); requests=limits per convention.
           resources {
             limits = {
-              memory = "256Mi"
+              memory = "384Mi"
             }
             requests = {
               cpu    = "50m"