fix: restore playwright/cpu-friendly config and deployment memory handling

playwright.config.ts

@@ -1,22 +1,39 @@
 import { defineConfig, devices } from "@playwright/test";
+
+// Deploy gate: keep this suite deterministic and light. One worker, one browser
+// engine, no live dev server and no parallelism — that is what keeps the host
+// from pinning at 100% CPU while the specs run.
 export default defineConfig({
 	testDir: "./e2e",
-	testIgnore: ["**/ui/**", "**/news-real/**", "**/quality/**"],
+	testIgnore: ["**/ui/**", "**/imaging/**", "**/news-real/**", "**/quality/**"],
+	forbidOnly: !!process.env.CI,
 	fullyParallel: false,
 	workers: 1,
-	retries: 1,
+	retries: process.env.CI ? 1 : 0,
 	timeout: 30000,
+	expect: { timeout: 10000 },
+	globalTimeout: 10 * 60 * 1000,
+	maxFailures: process.env.CI ? 10 : undefined,
 	reporter: [["list"], ["html", { open: "never" }]],
-	expect: {
-		toHaveScreenshot: {
-			animations: "disabled",
-			caret: "hide",
-			maxDiffPixelRatio: 0.02,
-		},
-	},
 	use: {
 		baseURL: process.env.PLAYWRIGHT_BASE_URL || "http://127.0.0.1:3002",
 		trace: "retain-on-failure",
+		screenshot: "only-on-failure",
+		video: "off",
+		launchOptions: {
+			args: [
+				"--disable-gpu",
+				"--disable-software-rasterizer",
+				"--disable-dev-shm-usage",
+				"--disable-background-networking",
+				"--disable-default-apps",
+				"--disable-extensions",
+				"--disable-sync",
+				"--metrics-recording-only",
+				"--mute-audio",
+				"--no-first-run",
+			],
+		},
 	},
 	projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
 });

scripts/ci-deploy.sh

@@ -42,9 +42,10 @@ old_container=""
 new_container=""
 blue_green=0
 
-# Resource limits bewust verwijderd: CPU en pids zijn eerder al gehaald. Memory
+# CPU en pids zijn bewust verwijderd; memory blijft gelimiteerd op 4g/5g swap
-# blijft bewust gelimiteerd op 4g/5g swap om een geheugenlek niet de host te
+# om een geheugenlek niet de host te laten vullen (MariaDB, nginx, Traefik).
-# laten vullen (MariaDB, nginx, Traefik als slachtoffer).
+mem_limit="4g"
+mem_swap_limit="5g"
 
 is_current() {
   local head

src/lib/docker-build-contract.test.ts

@@ -48,15 +48,15 @@ it("passes a compiled release to both the application build and final image", ()
 	expect(compose).toContain("NEXT_DEPLOYMENT_ID: ${CMS_RELEASE:-unknown}");
 });
 
-it("keeps the compose CMS opt-in and inside the 2 GB limit", () => {
+it("keeps the compose CMS opt-in and inside the 4 GB limit", () => {
 	const compose = readFileSync("docker-compose.yml", "utf8");
 	// A bare `docker compose up -d` starts only byparr. On a CI-managed host the
 	// CMS owns port 3002 through ci-deploy.sh; letting compose claim the same
 	// port again produces an endless EADDRINUSE crash loop.
 	expect(compose).toContain('profiles: ["cms"]');
 	expect(compose).not.toContain("cms-green");
-	expect(compose).toContain("mem_limit: 2g");
+	expect(compose).toContain("mem_limit: 4g");
-	expect(compose).toContain("memswap_limit: 2g");
+	expect(compose).toContain("memswap_limit: 5g");
 });
 
 it("builds with fixtures and excludes installation secrets from every stage", () => {