docs(onprem): add hardware sizing guidance for self-hosted Pro

[rossops]

Adds a public page with starting-point hardware recommendations for self-hosted DefectDojo Pro deployments, indexed by finding count and concurrent users. This guidance previously only existed in internal documents and got reassembled by hand for each request, which meant the numbers drifted. This gives it one home.

Specs are given as generic vCPU and memory figures so they apply to any cloud provider or on-premise hardware. The application node guidance assumes Kubernetes, and the page notes that a Docker Compose deployment on a single host should use the same totals.

Every tier is a range rather than a fixed number. Finding count is the headline figure, but it is not the only thing that drives sizing, so the page covers what pushes a deployment up a tier ahead of its finding count: import volume and frequency, deduplication breadth, reporting and dashboard load, API traffic from integrations, and retention policy.

Ranges are deliberately conservative. The floor of each range is a workable configuration and the ceiling leaves headroom, so a deployment provisioned anywhere inside a range has room to grow rather than needing a resize shortly after going live. The page is explicit that these are starting points rather than limits, and directs anyone at the top of the table to talk to us before provisioning.

Two points the page makes that are easy to get wrong:

• Database memory matters more than database CPU. Aggregation-heavy queries stay fast while the working set and its indexes are served from memory and degrade quickly once the database reaches for disk, so memory should be bought before cores.
• Application nodes track concurrent users, not finding count. The user figures in the table assume smaller datasets belong to smaller teams, and that assumption breaks often. The two layers scale independently.

Also reorders the on-premise section so the lifecycle reads size, install, migrate, upgrade.

Testing

• hugo --minify --gc --config config/production/hugo.toml builds clean, 636 pages, no errors.
• No new warnings. Verified by building this branch and its base separately and diffing the warning output. Identical, 8 before and 8 after, all pre-existing config-level deprecations.
• All internal anchors on the new page resolve against the built output, checked alongside the other three pages in the section.
• Sidebar ordering and section placement verified in the rendered HTML.

🤖 Generated with Claude Code