fc-desktop: add phase 1 capacity guards

apps/fc-desktop/limitrange.yaml

@@ -0,0 +1,33 @@
+# FlowerCore Remote Desktop - session pod resource defaults
+#
+# Namespace-level LimitRange for Sprint 44 Phase 1. This defends the
+# fc-desktop namespace from unbounded container requests while the
+# per-tenant advisory FairShareEvaluator lands in FlowerCore.RemoteDesktop.
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: fc-desktop-pod-defaults
+  namespace: fc-desktop
+  labels:
+    app.kubernetes.io/name: fc-desktop
+    app.kubernetes.io/part-of: remotedesktop
+    app.kubernetes.io/component: capacity-guard
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/owner: infra
+  annotations:
+    flowercore.io/phase: sprint-44-cx-9-phase-a
+spec:
+  limits:
+    - type: Container
+      default:
+        cpu: "1.0"
+        memory: "2Gi"
+      defaultRequest:
+        cpu: "500m"
+        memory: "1Gi"
+      max:
+        cpu: "2.0"
+        memory: "4Gi"
+      min:
+        cpu: "100m"
+        memory: "128Mi"