fix(k8s): add resource requests/limits to gateway sidecar container

## Problem
The gateway sidecar container in `k8s/14-mcp-gateway-sidecar.yaml` has no `resources:` block. Kubernetes cannot make scheduling decisions or enforce OOM isolation — a large MCP tool response can OOM-kill the pod with no warning.

## Fix
Add resource requests and limits to the gateway container spec:

```yaml
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 500m
memory: 256Mi
```

Tune values based on observed p99 usage from the Prometheus metrics once #300 is landed.

## Files
- `k8s/14-mcp-gateway-sidecar.yaml`
- `internal/operator/deployment.go` (operator-generated gateway container should also set defaults)