fix(ops): run heavy commands under a hard memory cap to stop host OOM kills

The host runs with vm.overcommit_memory=0 and no swap, so a process that
grows past free memory makes the kernel OOM-kill across the whole machine
-- the Turbopack build (commit 3d828a61) could take out the database,
nginx or the live release.

Add scripts/with-memory-cap.sh: it moves a command into its own systemd
scope with MemoryMax, so only that cgroup gets OOM-killed (verified: a
Turbopack build died at its 6GB cap, host untouched). Build/analyze/dev/
test*/typecheck now run under explicit caps; ulimit -v is only an explicit
opt-in because it bounds virtual address space per process and 10g/20g both
break V8-based builds. Docker and GitLab builds run in their own isolated
containers with a read-only cgroupfs and opt out explicitly (webpack +
--max-old-space-size stay their bound).

Measured: webpack build peaks ~6.5GB RSS, so 10GB leaves headroom within
the 23.5GB host.

.gitlab-ci.yml

@@ -1,5 +1,12 @@
 image: node:26
 
+# Runner containers have no systemd, so scripts/with-memory-cap.sh cannot
+# enforce an RSS cap there and correctly refuses to run unbounded. These
+# builds are already isolated inside their own runner container (not the
+# host) and use the webpack builder; opt out explicitly on purpose.
+variables:
+  CMS_MEMORY_CAP_BACKEND: "none"
+
 stages:
   - test
   - build

Dockerfile

@@ -6,7 +6,7 @@ ENV NEXT_TELEMETRY_DISABLED=1
 # Installeer git en pnpm v12
 RUN --mount=type=cache,target=/var/cache/apk \
     apk add --no-cache git \
-    && npm install -g pnpm@12.8.1
+    && npm install -g pnpm@12.10.1
 
 # Stel het PATH zo in dat Alpine pnpm gegarandeerd overal herkent
 ENV PNPM_HOME="/usr/local/share/pnpm"
@@ -31,7 +31,16 @@ ENV NEXT_DEPLOYMENT_ID="$NEXT_DEPLOYMENT_ID"
 # this 329-route app and gets OOM-killed; webpack peaks around 5GB. A
 # --max-old-space-size cap does NOT help, because that memory is native
 # Turbopack memory rather than the V8 heap.
+#
+# `pnpm run build` goes through scripts/with-memory-cap.sh. BuildKit's build
+# container has /sys/fs/cgroup mounted read-only (no cgroup MemoryMax) and
+# `ulimit -v` breaks V8-based builds (see the script header), so this stage
+# explicitly opts out of the cap. The real bound here is the webpack builder
+# + the V8 heap cap above, and the build runs isolated in its own container,
+# not on the host; the host itself is protected by the same wrapper through
+# systemd.
 ENV NODE_OPTIONS="--max-old-space-size=4096"
+ENV CMS_MEMORY_CAP_BACKEND=none
 
 # Bouw de Next.js applicatie met caching
 RUN --mount=type=cache,target=/app/.next/cache \

README.md

@@ -969,7 +969,7 @@ branch guard inside `ci-deploy.sh` only accepts `main`/`master`.
 | `pnpm db:bulk`            | Batch-import >50 MB JSON via `scripts/bulk-import-json.ts` |
 | `pnpm db:up` / `pnpm db:down` | Start / stop the `mariadb-turbo` container     |
 | `pnpm gamedata:compress`  | Pre-compress large gamedata JSON to `.gz` (gzip_static) |
-| `pnpm analyze`            | Build + open bundle analyzer                       |
+| `pnpm analyze`            | Build + report per-route bundle sizes              |
 | `pnpm jobs:worker`        | Start background task worker                       |
 | `pnpm biome:check`        | Lint and format code                               |
 
@@ -1098,7 +1098,7 @@ The CMS automatically translates furniture names and descriptions to **13 langua
 pnpm dev          # Start with hot reload
 pnpm typecheck    # Type check all files
 pnpm test         # Run test suite
-pnpm analyze      # Build and analyze bundle sizes
+pnpm analyze      # Build and report per-route bundle sizes
 pnpm biome:check  # Lint and format
 ```
 

src/features/housekeeping/foundation/foundation-source-contract.test.ts

@@ -266,7 +266,7 @@ function scanModuleAccesses(source: string): ModuleAccessScan {
 		} else if (value.type === "ImportExpression") {
 			recordArgument(value.source, "import");
 		} else if (value.type === "TSImportType") {
-			recordArgument(value.argument, "import");
+			recordArgument(value.source ?? value.argument, "import");
 		} else if (
 			value.type === "CallExpression" ||
 			value.type === "OptionalCallExpression"

src/features/housekeeping/foundation/preview-route-contract.test.ts

@@ -255,7 +255,7 @@ function scanModuleAccesses(source: string): ModuleAccessScan {
 		} else if (value.type === "ImportExpression") {
 			recordArgument(value.source, "import");
 		} else if (value.type === "TSImportType") {
-			recordArgument(value.argument, "import");
+			recordArgument(value.source ?? value.argument, "import");
 		} else if (
 			value.type === "CallExpression" ||
 			value.type === "OptionalCallExpression"