chore(infra): add Node heap caps to api worker deployments

bg, worker-job, temporal, and private ran Node with no
--max-old-space-size, so V8 used its default heap sizing (derived from
the node's total RAM, not the pod limit) and could grow past the cgroup
limit and OOM with no early-GC backstop. Cap each at 90% of its limit
via the shared nodeOptions helper, matching api/ws. personalized-digest
left uncapped intentionally so it can absorb load spikes.

Author: idoshamun

.infra/index.ts

@@ -232,18 +232,24 @@ const wsLimits: pulumi.Input<{
   memory: `${wsMemory}Mi`,
 };
 
-const bgLimits: pulumi.Input<{ memory: string }> = { memory: '512Mi' };
+const bgMemory = 512;
+const bgLimits: pulumi.Input<{ memory: string }> = { memory: `${bgMemory}Mi` };
 const bgRequests: pulumi.Input<{ cpu: string; memory: string }> = {
   cpu: '50m',
   memory: '256Mi',
 };
 
-const temporalLimits: pulumi.Input<{ memory: string }> = { memory: '560Mi' };
+const temporalMemory = 560;
+const temporalLimits: pulumi.Input<{ memory: string }> = {
+  memory: `${temporalMemory}Mi`,
+};
 const temporalRequests: pulumi.Input<{ cpu: string; memory: string }> = {
   cpu: '10m',
   memory: '280Mi',
 };
 
+const privateMemory = 700;
+
 const initialDelaySeconds = 20;
 const readinessProbe: k8s.types.input.core.v1.Probe = {
   httpGet: { path: '/health', port: 'http' },
@@ -463,7 +469,7 @@ if (isAdhocEnv) {
     },
     {
       nameSuffix: 'bg',
-      env: [...jwtEnv],
+      env: [nodeOptions(bgMemory), ...jwtEnv],
       args: cliArgs('background'),
       minReplicas: 2,
       maxReplicas: 10,
@@ -485,7 +491,7 @@ if (isAdhocEnv) {
     },
     {
       nameSuffix: 'temporal',
-      env: [...jwtEnv],
+      env: [nodeOptions(temporalMemory), ...jwtEnv],
       args: cliArgs('temporal'),
       minReplicas: 1,
       maxReplicas: 3,
@@ -501,15 +507,19 @@ if (isAdhocEnv) {
     {
       nameSuffix: 'private',
       port: 3000,
-      env: [{ name: 'ENABLE_PRIVATE_ROUTES', value: 'true' }, ...jwtEnv],
+      env: [
+        nodeOptions(privateMemory),
+        { name: 'ENABLE_PRIVATE_ROUTES', value: 'true' },
+        ...jwtEnv,
+      ],
       minReplicas: 1,
       maxReplicas: 4,
       requests: {
         memory: '350Mi',
         cpu: '10m',
       },
       limits: {
-        memory: '700Mi',
+        memory: `${privateMemory}Mi`,
       },
       readinessProbe,
       livenessProbe,
@@ -557,7 +567,7 @@ if (isAdhocEnv) {
 
   appsArgs.push({
     nameSuffix: 'worker-job',
-    env: [...jwtEnv],
+    env: [nodeOptions(bgMemory), ...jwtEnv],
     args: cliArgs('worker-job'),
     minReplicas: 1,
     maxReplicas: 10,