Wire the memory envelope into the k8s ConfigMap; bring STATUS.md up to date

The container limit is 1Gi, so declare the envelope next to it: a 1GiB soft
heap limit, a 256MiB reserve for what the Go heap does not account for, and an
explicit 384MiB cache byte budget. cache.size is an entry count, so the byte
budget is what actually bounds the cache now that ParseSize applies its units.

STATUS.md records the round: the fixes, the new suites (engine, config.Size,
metrics, and the api suite that landed separately), three findings left
unfixed -- the login rate limiter never applies to the login endpoint, auth
configuration is frozen at New, and api.constantTimeEqual is dead -- and the
continuation plan with items 1, 2, 5 and 6 struck.

deploy/k8s/00-config.yaml

@@ -50,6 +50,22 @@ data:
           proto: tls
           server_name: dns.quad9.net
 
+    # Memory envelope. The container limit (1Gi, in the StatefulSet) is the
+    # hard ceiling; this tells the process about it so the collector works to
+    # a target instead of being OOM-killed. `limit` is the soft GOMEMLIMIT and
+    # must be at or below the container limit; `reserve` covers what the Go
+    # heap does not account for — goroutine stacks, runtime metadata, and the
+    # mmapped cache snapshot and query log.
+    #
+    # The cache byte budget is derived (60% of limit - reserve) unless it is
+    # set explicitly. cache.size below is an *entry count*, so this is what
+    # actually bounds the cache's memory: 500k entries of a few hundred bytes
+    # each is well past 384MiB, and the byte budget is what will bite first.
+    memory:
+      limit: 1GiB
+      reserve: 256MiB
+      cache_max_bytes: 384MiB
+
     cache:
       enabled: true
       size: 500000