feat(infra): add launch readiness quick wins

- Add mem_limit to all 6 app containers (db: 512m, redis: 128m,
  api: 512m, celery-worker: 512m, celery-beat: 128m, flower: 128m)
- Restrict Flower port to localhost (127.0.0.1:5555:5555)
- Add PostgreSQL and Redis health checks to /health/ready endpoint
  with individual check details (name, status, latency)
- Add scaling guide with metrics, thresholds, Hetzner pricing
- Add server verification script (12 infrastructure checks)
- Update hetzner-server-setup.md with progress and pending tasks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -12,6 +12,7 @@ services:
       - ./init.sql:/docker-entrypoint-initdb.d/init.sql
     ports:
       - "5432:5432"
+    mem_limit: 512m
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U orion_user -d orion_db"]
       interval: 30s
@@ -25,6 +26,7 @@ services:
     restart: always
     ports:
       - "6380:6379"  # Use 6380 to avoid conflict with host Redis
+    mem_limit: 128m
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 30s
@@ -54,6 +56,7 @@ services:
     volumes:
       - ./logs:/app/logs
       - ./uploads:/app/uploads
+    mem_limit: 512m
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s
@@ -83,6 +86,7 @@ services:
     volumes:
       - ./logs:/app/logs
       - ./exports:/app/exports
+    mem_limit: 512m
     healthcheck:
       test: ["CMD-SHELL", "celery -A app.core.celery_config inspect ping --timeout 10 || exit 1"]
       interval: 30s
@@ -103,6 +107,7 @@ services:
     depends_on:
       redis:
         condition: service_healthy
+    mem_limit: 128m
     healthcheck:
       disable: true
     networks:
@@ -116,13 +121,14 @@ services:
       - full  # Only start with: docker compose --profile full up -d
     command: celery -A app.core.celery_config flower --port=5555
     ports:
-      - "5555:5555"
+      - "127.0.0.1:5555:5555"
     environment:
       REDIS_URL: redis://redis:6379/0
       FLOWER_BASIC_AUTH: ${FLOWER_USER:-admin}:${FLOWER_PASSWORD:-changeme}
     depends_on:
       redis:
         condition: service_healthy
+    mem_limit: 128m
     healthcheck:
       test: ["CMD-SHELL", "curl -f http://localhost:5555/ || exit 1"]
       interval: 30s