perf(infra): cap OpenZaak + NRC uWSGI to 1 worker — shrink verify-stack footprint (closes #147)

Follow-up to #145. OpenZaak and NRC (nrc-web) are Maykin/vng uWSGI images
running the image default of 4 processes × 4 threads — ~4 full-Django
worker processes (~800 MB) each, idle, on the single shared runner. As the
stack grew to 37 services this pressure made verify-stack struggle.

Set UWSGI_PROCESSES=1 + UWSGI_THREADS=2 on the &oz-env / &nrc-env anchors
in both compose files. These APIs serve single-request smoke checks and are
not load-tested, so 1 worker suffices; ~1.2 GB freed. The anchors are shared
with the -init (setup_configuration) and -celery containers, which ignore
the var (they don't run uwsgi).

Verified locally: OpenZaak healthy with the cap, uwsgi processes 6→3, admin
still 302. docker compose config clean on both files.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

infra/docker-compose.local.yml

@@ -56,6 +56,10 @@ services:
   oz-init:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — idle workers pressure the runner; the
+      # -init/-celery containers share this anchor and ignore it (they don't run uwsgi).
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: oz-db
@@ -138,6 +142,9 @@ services:
     # bind-mounted here (this twin is the local/no-make path). See ADR-0007.
     image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: nrc-db

infra/docker-compose.yml

@@ -51,6 +51,12 @@ services:
   oz-init:
     image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2}
     environment: &oz-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147, same lever as #145): OpenZaak serves
+      # single-request smoke checks here and is not load-tested, so 4 idle Django workers just pin
+      # ~800 MB and pressure the shared runner. The -init (setup_configuration) and -celery containers
+      # share this anchor and ignore it — they don't run uwsgi.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: openzaak.conf.docker
       SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: oz-db
@@ -135,6 +141,9 @@ services:
     # needs no baked config.
     image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1}
     environment: &nrc-env
+      # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above.
+      UWSGI_PROCESSES: "1"
+      UWSGI_THREADS: "2"
       DJANGO_SETTINGS_MODULE: nrc.conf.docker
       SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production}
       DB_HOST: nrc-db