fix(security): isolate template rendering with hard resource limits

docs/ADMIN_GUIDE.md

@@ -36,3 +36,21 @@ Apply the module Alembic migration before startup. Monitor rejected renders for
 contract drift, output limits, missing Files permission, and reused idempotency
 keys. HTML is designed for browser/OS printing; do not treat it as a signed PDF
 or proof of physical printer delivery.
+
+Pure rendering runs in a disposable Core worker after authorization, revision
+selection and idempotency lookup. Each worker has a 15-second wall limit,
+10 CPU seconds, 512 MiB address space and no file output. Typed input transport
+is limited to 32 MiB and result transport to 8 MiB, including serialization
+overhead; nesting is limited to 64 levels and 1,000,000 value nodes. The existing
+5 MiB final output and 5,000-item limits remain. Only data DTOs cross the
+boundary; principals, SQL sessions, credentials and artifact writes stay in the
+parent. Completed idempotent renders return before a worker is started.
+
+`GOVOPLAN_ISOLATED_PROCESS_CONCURRENCY` in Core controls active isolated work per
+API/worker process without queuing. Busy capacity produces a sanitized retryable
+render error. CPU, memory, transport or time failures stop the entire render
+before artifact persistence; reduce the workload before retrying. POSIX process
+resource controls are required. Missing controls, cancellation or worker failure
+fails closed with no in-process fallback. Budget aggregate memory across all
+slots and API/worker replicas; monitor limit and overload errors separately
+from template compatibility errors.

docs/USER_GUIDE.md

@@ -21,3 +21,13 @@ Open **Templates** to create or select a reusable definition.
 Render evidence shows the exact revision and abbreviated template, input, and
 output hashes. A consumer such as Campaign can submit many frozen recipients;
 the UI sample intentionally validates one representative item.
+
+Rendering is also limited to 15 seconds elapsed time, 10 CPU seconds, 512 MiB
+process memory, 32 MiB serialized input and 8 MiB serialized result transport;
+the final output remains limited to 5 MiB and 5,000 items. Deeply nested data
+or more than 1,000,000 transported value nodes is rejected. A limit error creates
+no partial output or render evidence: reduce the selected input or template
+complexity and retry. If processing capacity is busy, retry later. Unavailable
+worker controls or a worker failure require operator investigation. Existing
+successful output with the same idempotency key is reused without rendering
+again, provided its input and authorization still match.