deploy: a process ceiling on every container (audit I3)

Security audit 2026-10-17, finding I3 (low), stage 4. No compose file set
pids_limit: a fork bomb from a compromised panel or postfix had the host's
pid space as its limit. Now 1024 for SelfPost - the plan said 512, but
Postfix starts up to default_process_limit (100) processes per service,
and a busy server runs three smtpd services, cleanup and smtp at once -
256 for nginx, Caddy, Traefik and rspamd, 64 for certbot. The comment that
said root runs "very briefly" now says which root processes stay.

e2e: checkPidsLimit reads /sys/fs/cgroup/pids.max in the container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/nginx/docker-compose.nginx.yml

@@ -47,6 +47,8 @@ services:
   nginx:
     image: nginx:1.27
     restart: unless-stopped
+    # A ceiling on processes and threads (security audit 2026-10-17, I3).
+    pids_limit: 256
     depends_on:
       - selfpost
     ports:
@@ -59,6 +61,7 @@ services:
 
   certbot:
     image: certbot/certbot:latest
+    pids_limit: 64
     volumes:
       - ./nginx/certbot-etc:/etc/letsencrypt
       - ./nginx/certbot-www:/var/www/certbot