Add default resource limits to MCPRemoteProxy

Problem

MCPRemoteProxy currently does not have default resource limits, which creates the same security and operational risks that were addressed for MCPServer and VirtualMCPServer in #2873.

Current Behavior

cmd/thv-operator/controllers/mcpremoteproxy_deployment.go:31

resources := ctrlutil.BuildResourceRequirements(proxy.Spec.Resources)

This only uses user-provided resources with no defaults. If spec.resources is not specified, the container gets unlimited resources.

Expected Behavior

MCPRemoteProxy should:

1. Use proxy runner defaults (50m/200m CPU, 64Mi/256Mi memory) when spec.resources is not specified
2. Merge user-provided values with defaults (user values take precedence)
3. Update deploymentNeedsUpdate to check resources properly

Implementation

Apply the same pattern used for VirtualMCPServer in #2873:

func resourceRequirementsForRemoteProxy(proxy *mcpv1alpha1.MCPRemoteProxy) corev1.ResourceRequirements {
    defaultResources := ctrlutil.BuildDefaultProxyRunnerResourceRequirements()
    userResources := ctrlutil.BuildResourceRequirements(proxy.Spec.Resources)
    return ctrlutil.MergeResourceRequirements(defaultResources, userResources)
}

Then use it in:

• deploymentForMCPRemoteProxy (line 31)
• deploymentNeedsUpdate (line 691 in mcpremoteproxy_controller.go)

Files to Update

• cmd/thv-operator/controllers/mcpremoteproxy_deployment.go
• cmd/thv-operator/controllers/mcpremoteproxy_controller.go
• Add tests similar to virtualmcpserver_deployment_test.go

Related

• Issue #2873 - Add default resource limits to VirtualMCPServer vmcp container
• PR addressing MCPServer and VirtualMCPServer defaults

Security/Operational Impact

Without defaults:

• Remote proxy containers can monopolize cluster resources
• No protection against runaway processes
• Inconsistent behavior across MCPServer, VirtualMCPServer, and MCPRemoteProxy

Labels

• enhancement
• operator
• security
• good first issue (pattern is well-established)