chore(deploy): 数据库与各服务增加资源限制和优雅关闭保护

- postgres 增加 mem_limit/cpus/shm_size/stop_grace_period 与 PG
  性能参数(shared_buffers 等,env 可覆盖);backend/web 增加
  内存/CPU 限额与更长的优雅关闭宽限(生产与开发编排同步)
- ubuntu-deploy.sh 增加部署前磁盘空间预检,防止备份或迁移
  中途磁盘写满
- .env.server.example 补充资源变量;文档补充容器资源限制说明

docker-compose.yml

@@ -8,6 +8,7 @@ services:
   postgres:
     image: docker.m.daocloud.io/library/postgres:16-bookworm
     # 开启 pg_stat_statements，便于定位生产环境累计最耗时的 SQL。
+    # 内存类参数按 2G 内存机器给出默认值，请按服务器内存调整（见 .env.server.example）。
     command:
       [
         "postgres",
@@ -17,8 +18,21 @@ services:
         "pg_stat_statements.track=all",
         "-c",
         "log_min_duration_statement=${POSTGRES_LOG_MIN_DURATION_STATEMENT_MS:-500}",
+        "-c",
+        "shared_buffers=${POSTGRES_SHARED_BUFFERS:-256MB}",
+        "-c",
+        "effective_cache_size=${POSTGRES_EFFECTIVE_CACHE_SIZE:-1GB}",
+        "-c",
+        "work_mem=${POSTGRES_WORK_MEM:-8MB}",
+        "-c",
+        "maintenance_work_mem=${POSTGRES_MAINTENANCE_WORK_MEM:-128MB}",
       ]
     restart: unless-stopped
+    # 让 PostgreSQL 优雅关闭有足够时间完成检查点；无限制时 OOM 可能拖垮整机。
+    mem_limit: ${POSTGRES_MEM_LIMIT:-1g}
+    cpus: ${POSTGRES_CPUS:-2}
+    shm_size: 512mb
+    stop_grace_period: 60s
     logging: *json-log-rotation
     environment:
       TZ: ${TZ:-Asia/Shanghai}
@@ -46,6 +60,10 @@ services:
         DEBIAN_MIRROR: ${DEBIAN_MIRROR:-mirrors.aliyun.com}
         NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
     restart: unless-stopped
+    # 30s 让后端在 SIGTERM 后完成优雅关闭（HTTP 连接收尾 + 数据库连接池释放）。
+    mem_limit: ${BACKEND_MEM_LIMIT:-512m}
+    cpus: ${BACKEND_CPUS:-1}
+    stop_grace_period: 30s
     env_file:
       - .env
     depends_on:
@@ -101,6 +119,9 @@ services:
         ALPINE_MIRROR: ${ALPINE_MIRROR:-mirrors.aliyun.com}
         NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
     restart: unless-stopped
+    mem_limit: ${WEB_MEM_LIMIT:-256m}
+    cpus: ${WEB_CPUS:-0.5}
+    stop_grace_period: 20s
     logging: *json-log-rotation
     depends_on:
       backend: