feat: bootstrap repo — enforcement layer + #685 perf capture

Enforcement (check-rules/hooks/shellcheck) per ADOPTING pattern; perf/ SoR
from the #685 session (memcensus, pg role-caps SQL, applied sysctl, planned
daemon.json); questions-v1 (API token + dockerd window asks).

Meat + verification: https://projects.knownelement.com/issues/727#note-3913

perf/docker-daemon.json.planned

@@ -0,0 +1,8 @@
+{
+  "log-driver": "json-file",
+  "log-opts": { "max-size": "10m", "max-file": "3" },
+  "default-ulimits": {
+    "nofile": { "Name": "nofile", "Soft": 262144, "Hard": 262144 }
+  },
+  "live-restore": true
+}

perf/memcensus.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# perf/memcensus.sh — per-app memory limit vs usage census on tsys-cloudron [#685]
+#
+# Final v3 (v1/v2 had usage-parsing bugs; superseded). Reports per-container
+# waste (limit minus usage) for apps with >=1GB limits — the basis for the
+# memory-slider shrink table on Discourse t/316.
+#
+# Run (read-only, from a KNEL/PFVCluster checkout):
+#   VM_IP=my.knownelement.com VM_USER=root timeout 120 bash tests/remote.sh vm-file perf/memcensus.sh
+# Needs: docker + awk on the host.
+# memory census v3 [#685]
+docker stats --no-stream --format "{{.Name}} {{.MemUsage}}" > /tmp/ms3.txt
+docker ps --format "{{.Names}}" | while read -r n; do
+  lim=$(docker inspect "$n" --format '{{.HostConfig.Memory}}' 2>/dev/null)
+  fq=$(docker inspect "$n" --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null | grep -m1 '^CLOUDRON_APP_DOMAIN=' | cut -d= -f2)
+  [ -z "$fq" ] && fq=$(docker inspect "$n" --format '{{.Config.Image}}' 2>/dev/null | sed 's|.*/||;s|:.*||')
+  echo "$n|$fq|$lim"
+done > /tmp/ml3.txt
+awk 'NR==FNR {
+    gsub(/,/,"");
+    if ($2 ~ /G/) u[$1] = $2 * 1024; else u[$1] = $2 + 0;
+    next
+  }
+  {
+    split($0, f, "|")
+    lim = f[3] / 1048576
+    use = u[f[1]] + 0
+    if (lim >= 1024)
+      printf "%7.0fMB | %-46s | %6.0fMB | %6.0fMB | %3.0f%%\n", lim - use, f[2], lim, use, (lim ? use / lim * 100 : 0)
+  }' /tmp/ms3.txt /tmp/ml3.txt | sort -t'|' -k1 -rn | head -30

perf/pg-role-caps.sql

@@ -0,0 +1,22 @@
+-- perf/pg-role-caps.sql — platform Postgres role caps + scaling, tsys-cloudron [#685]
+--
+-- Applied live 2026-09-02 (canary-first: booking.roguetechnologies.net alone,
+-- verified 61 -> 10 conns + app 200, then the rest). This file is the
+-- idempotent re-apply SoR for IaC. Narrative + measurements: Discourse t/316.
+-- Rollback (instant, no restarts): ALTER ROLE <username> CONNECTION LIMIT -1;
+--
+-- Run inside the postgresql container:
+--   docker exec -i postgresql su - postgres -c 'psql' < perf/pg-role-caps.sql
+--
+-- Re-run safe: the \gexec block only caps app roles (rolname LIKE 'user%')
+-- still at -1, so new apps get the default 20-cap as they are added.
+-- Also already persisted (postgresql.auto.conf, survives restarts):
+--   ALTER SYSTEM SET shared_buffers = '2GB';  -- needed the two 18:0x CDT restarts
+
+SELECT 'ALTER ROLE ' || rolname || ' CONNECTION LIMIT 20;'
+FROM pg_roles WHERE rolname LIKE 'user%' AND rolconnlimit = -1
+\gexec
+ALTER SYSTEM SET max_connections = 700;
+ALTER SYSTEM SET idle_in_transaction_session_timeout = '15min';
+SELECT rolname, rolconnlimit FROM pg_roles WHERE rolconnlimit <> -1 ORDER BY rolconnlimit, rolname;
+SHOW max_connections;

perf/sysctl/99-cloudron-tuning.conf

@@ -0,0 +1,5 @@
+# /etc/sysctl.d/99-cloudron-tuning.conf — tsys-cloudron, applied 2026-09-02 [#685]
+# Live-verified 2026-09-02 (vm.swappiness=10 confirmed at runtime).
+# SoR copy for IaC; deploy = copy to /etc/sysctl.d/ + sysctl --system
+# (ansible/ playbook target).
+vm.swappiness=10