feat: harden auth and stream uploads

docker/docker-compose.prod.yml

@@ -25,6 +25,8 @@ x-imageforge-environment: &imageforge-environment
 services:
   postgres:
     image: postgres:16-alpine
+    mem_limit: ${POSTGRES_MEMORY_LIMIT:-2g}
+    pids_limit: 256
     environment:
       POSTGRES_DB: imageforge
       POSTGRES_USER: imageforge
@@ -40,7 +42,9 @@ services:
 
   redis:
     image: redis:7-alpine
-    command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "noeviction"]
+    mem_limit: ${REDIS_MEMORY_LIMIT:-1g}
+    pids_limit: 128
+    command: ["redis-server", "--appendonly", "yes", "--maxmemory", "${REDIS_MAXMEMORY:-768mb}", "--maxmemory-policy", "noeviction"]
     volumes:
       - redis_data:/data
     healthcheck:
@@ -52,6 +56,8 @@ services:
 
   api:
     image: imageforge:${IMAGEFORGE_TAG:-local}
+    mem_limit: ${API_MEMORY_LIMIT:-3g}
+    pids_limit: 256
     build:
       context: ..
       dockerfile: docker/Dockerfile
@@ -102,6 +108,8 @@ services:
 
   worker:
     image: imageforge:${IMAGEFORGE_TAG:-local}
+    mem_limit: ${WORKER_MEMORY_LIMIT:-8g}
+    pids_limit: 512
     init: true
     environment:
       <<: *imageforge-environment