deploy: a process ceiling on every container (audit I3)

Security audit 2026-10-17, finding I3 (low), stage 4. No compose file set
pids_limit: a fork bomb from a compromised panel or postfix had the host's
pid space as its limit. Now 1024 for SelfPost - the plan said 512, but
Postfix starts up to default_process_limit (100) processes per service,
and a busy server runs three smtpd services, cleanup and smtp at once -
256 for nginx, Caddy, Traefik and rspamd, 64 for certbot. The comment that
said root runs "very briefly" now says which root processes stay.

e2e: checkPidsLimit reads /sys/fs/cgroup/pids.max in the container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -30,6 +30,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   only a request with no `X-Forwarded-For` from loopback or a private
   address gets the liveness answer - the container's own check, the host,
   a monitor next to it; the internet gets `404`.
+- **Every container has a process ceiling** (audit I3): `pids_limit` 1024
+  for SelfPost, 256 for the proxies and rspamd, 64 for certbot.
 - **The TLS private key no longer has to be readable by Postfix** (audit
   I1): the guide gave it to group 10998 for the panel's backup, and
   `postfix` is in that group, so every Postfix daemon - an smtpd talking to