fix: right-size resource limits for free-tier hosts, consolidate app into single container

[mcansem]

Two related but distinct changes, kept as separate commits:

fix: right-size resource limits for free-tier hosts, add swap safety net

Previous deploy.resources.limits summed to ~2.5x the physical RAM on both
target hosts (management: AWS t3.small 2GB, app: Google Cloud e2-micro 1GB).
Revised every stack's memory/cpu limits down to realistic usage, and gave
Jenkins an explicit JVM heap percentage so it scales off the container's
cgroup limit instead of assuming host RAM.

Added swap provisioning to scripts/harden-host.sh (1G management, 512M
app/agent) as a safety net against worst-case simultaneous memory peaks -
not a substitute for right-sized limits, insurance against them anyway.

Also fixes docs/platforms/aws.md, which still recommended a larger instance
than the actual free-tier target and referenced stale totals.

refactor: consolidate app's nextjs+dotnet-api into a single container

The real application builds one image, not two: a 3-stage Dockerfile
(Next.js static export -> .NET publish -> export copied into the API's
wwwroot) ships one ASP.NET Core process serving both frontend and API.
docker/app/docker-compose.yml, nginx/app.conf's routing, and every doc
describing the old two-container split are updated to match.

Also replaces WEB_IMAGE_TAG/API_IMAGE_TAG with a single, required
APP_IMAGE_NAME (no default) - this repo isn't tied to one project's
naming - and fixes docs/platforms/google-cloud.md's stale instance-sizing
guidance.

Frees ~220M on the already-tight app host as a side effect.

Test plan

• bash -n on all edited shell scripts (clean)
• Manual review of every compose file diff for YAML/reference correctness
• Repo-wide grep sweep for stale nextjs/dotnet-api/portfolio-web/portfolio-api references (none found)
• CI: shellcheck / markdownlint / compose-validate
• Real host test (tomorrow, per plan)