fc-desktop: add phase 1 capacity guards

apps/fc-desktop/limitrange.yaml

@@ -0,0 +1,33 @@
+# FlowerCore Remote Desktop - session pod resource defaults
+#
+# Namespace-level LimitRange for Sprint 44 Phase 1. This defends the
+# fc-desktop namespace from unbounded container requests while the
+# per-tenant advisory FairShareEvaluator lands in FlowerCore.RemoteDesktop.
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: fc-desktop-pod-defaults
+  namespace: fc-desktop
+  labels:
+    app.kubernetes.io/name: fc-desktop
+    app.kubernetes.io/part-of: remotedesktop
+    app.kubernetes.io/component: capacity-guard
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/owner: infra
+  annotations:
+    flowercore.io/phase: sprint-44-cx-9-phase-a
+spec:
+  limits:
+    - type: Container
+      default:
+        cpu: "1.0"
+        memory: "2Gi"
+      defaultRequest:
+        cpu: "500m"
+        memory: "1Gi"
+      max:
+        cpu: "2.0"
+        memory: "4Gi"
+      min:
+        cpu: "100m"
+        memory: "128Mi"

apps/fc-desktop/resourcequota.yaml

@@ -0,0 +1,36 @@
+# FlowerCore Remote Desktop - namespace ResourceQuota (GitOps-managed)
+#
+# Adopts the live fc-desktop-session-cap object created during the
+# 2026-05-19 prewarm-cascade triage. Sprint 44 Phase 1 keeps the pod,
+# CPU, and memory guard unchanged, then adds storage/PVC backstops from
+# the fc-desktop CPU expansion substrate.
+#
+# Two-phase deploy note:
+#   Phase A: apply this ResourceQuota and limitrange.yaml with the current
+#   FlowerCore.RemoteDesktop image.
+#   Phase B: bump the service image only after the RemoteDesktop service
+#   admission/fair-share code lands in that repo.
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: fc-desktop-session-cap
+  namespace: fc-desktop
+  labels:
+    app.kubernetes.io/name: fc-desktop
+    app.kubernetes.io/part-of: remotedesktop
+    app.kubernetes.io/component: capacity-guard
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/owner: infra
+  annotations:
+    flowercore.io/rationale: |
+      Operator-requested limit 2026-05-19: cluster CPU exhausted by RD
+      pool prewarm cascade. Preserve count/pods=15 plus requests.cpu=8
+      and requests.memory=16Gi until capacity expansion lands.
+    flowercore.io/phase: sprint-44-cx-9-phase-a
+spec:
+  hard:
+    count/pods: "15"
+    requests.cpu: "8"
+    requests.memory: "16Gi"
+    requests.storage: "500Gi"
+    persistentvolumeclaims: "30"