deploy: a process ceiling on every container (audit I3)

Security audit 2026-10-17, finding I3 (low), stage 4. No compose file set
pids_limit: a fork bomb from a compromised panel or postfix had the host's
pid space as its limit. Now 1024 for SelfPost - the plan said 512, but
Postfix starts up to default_process_limit (100) processes per service,
and a busy server runs three smtpd services, cleanup and smtp at once -
256 for nginx, Caddy, Traefik and rspamd, 64 for certbot. The comment that
said root runs "very briefly" now says which root processes stay.

e2e: checkPidsLimit reads /sys/fs/cgroup/pids.max in the container.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -799,8 +799,11 @@ the argument.
 
 ### Stage 4 — resources and imports (~5 h)
 
-- [ ] **I3.** `pids_limit: 512` in every compose fragment; the comment
-  corrected; one e2e run. — **Sonnet**, 0.5 h.
+- [x] **I3.** `pids_limit: 512` in every compose fragment; the comment
+  corrected; one e2e run. — **Sonnet**, 0.5 h. *Done 2026-10-17:* 1024 for
+  SelfPost (Postfix's default_process_limit of 100 per service, three smtpd
+  services), 256 for the proxies and rspamd, 64 for certbot; e2e reads
+  `pids.max` back (checkPidsLimit).
 - [ ] **W6/M9.** Coalesce Postfix reloads (reload only when the rendered map
   changed; a 2 s debounce for bursts); a per-user limiter on `dns-recheck`.
   — **Opus**, 1.5 h.