Merge branch 'release/v3.8.8' into feat/quota-share-redesign

# Conflicts:
#	src/lib/db/apiKeys.ts
#	src/lib/db/migrationRunner.ts
#	src/server/authz/policies/management.ts
#	src/server/authz/routeGuard.ts
#	tests/unit/route-guard-private-lan.test.ts

scripts/dev/run-standalone.mjs

@@ -4,12 +4,22 @@ import { existsSync } from "node:fs";
 import {
   resolveRuntimePorts,
   withRuntimePortEnv,
+  resolveMaxOldSpaceMb,
   spawnWithForwardedSignals,
 } from "../build/runtime-env.mjs";
 import { bootstrapEnv } from "../build/bootstrap-env.mjs";
 
 const env = bootstrapEnv();
 const runtimePorts = resolveRuntimePorts(env);
+const childEnv = withRuntimePortEnv(env, runtimePorts);
+
+// #2939: honor OMNIROUTE_MEMORY_MB (default 512), the same knob
+// `omniroute serve` uses, so Docker users can control the server heap under
+// load / large SQLite DBs. A trailing --max-old-space-size wins, so this
+// overrides the image fallback without clobbering any other NODE_OPTIONS flags.
+const maxOldSpaceMb = resolveMaxOldSpaceMb(childEnv.OMNIROUTE_MEMORY_MB);
+childEnv.NODE_OPTIONS =
+  `${childEnv.NODE_OPTIONS || ""} --max-old-space-size=${maxOldSpaceMb}`.trim();
 
 // Prefer the WS-aware wrapper (server-ws.mjs) over the bare Next standalone
 // server.js: it installs the trusted peer-IP stamp (scripts/dev/peer-stamp.mjs)
@@ -20,5 +30,5 @@ const entry = existsSync("server-ws.mjs") ? "server-ws.mjs" : "server.js";
 
 spawnWithForwardedSignals("node", [entry], {
   stdio: "inherit",
-  env: withRuntimePortEnv(env, runtimePorts),
+  env: childEnv,
 });