perf(memory): report real RSS and cut footprint via GOGC + periodic release

The Usage card showed runtime.MemStats.Sys, a never-shrinking high-water mark of reserved address space that also counts memory already returned to the OS, so it overstated real usage (e.g. ~300 MB on an idle 1-client server). Report process RSS instead so the number matches the OS and drops as memory is freed.

Replace the auto GOMEMLIMIT that targeted ~90 percent of total system RAM (a near no-op while the heap sits far below the limit, and a GC-thrash risk on small/shared VPS per go.dev/doc/gc-guide) with: a lower default GOGC (XUI_GOGC, default 75), a periodic debug.FreeOSMemory job (XUI_MEMORY_RELEASE_INTERVAL, default 10m, 0 disables), and a soft limit applied only from an explicit budget (GOMEMLIMIT, XUI_MEMORY_LIMIT, or a real cgroup cap at 90 percent).

internal/web/job/free_os_memory.go

@@ -0,0 +1,19 @@
+package job
+
+import "runtime/debug"
+
+// MemoryReleaseJob returns freed heap spans to the OS so steady-state RSS tracks
+// the live heap between the bursty traffic-collection jobs, instead of lingering
+// at the high-water mark until the scavenger lazily reclaims it.
+type MemoryReleaseJob struct{}
+
+// NewMemoryReleaseJob creates a new memory-release job instance.
+func NewMemoryReleaseJob() *MemoryReleaseJob {
+	return new(MemoryReleaseJob)
+}
+
+// Run forces a GC and returns as much free memory to the OS as possible. It is
+// scheduled on a minutes cadence because FreeOSMemory triggers a full GC.
+func (j *MemoryReleaseJob) Run() {
+	debug.FreeOSMemory()
+}