fix(lifecycle): tighten shutdown ordering for DLQ metrics + AI workers + DLQ replay cap

[aksOps]

Summary

Three lifecycle fixes surfaced by the codex round-2 production-readiness review. All three are bounded changes, opt-in defaults, no behaviour-breaking shifts for existing deployments.

• DLQ metrics goroutine leak — the Size()/DiskBytes() poller had no exit condition. After dlq.Stop() ran (LIFO step 4) it kept polling on the closed DLQ and raced the file-handle close in repo.Close() (step 6). Goroutine now selects on appCtx.Done() and is registered with bootWG so it exits before dlq.Stop().
• AI worker shutdown stall — analyzeLog was using context.Background(), so once aiService.Stop() was called the workers held the goroutine open until each in-flight 30s LLM call returned naturally. Workers now derive their context from a shutdown-aware aiCtx (cancel-derived from appCtx) via SetParentContext. aiCancel() runs immediately before aiService.Stop() in shutdown step 2, so in-flight calls abort within milliseconds instead of holding shutdown hostage for up to 30s × workerPool.
• DLQ replay-per-tick cap — DLQ_MAX_REPLAY_PER_TICK (default 100). Without it, an outage that filled the DLQ with 10k files would replay every file in the first post-restart tick, hammering the just-restarted DB and exhausting connection-pool capacity. Backoff-skipped files do not count toward the cap (they cost nothing). 0 disables the cap (legacy behaviour).

Files

• internal/ai/service.go — parentCtx field + SetParentContext. Workers fall back to context.Background() when the setter isn't called (preserves embedded-caller behaviour).
• internal/queue/dlq.go — maxReplayPerTick field + SetMaxReplayPerTick(n) (clamps negative to 0). processFiles reads the cap once under the mutex, then breaks when actual replayFn invocations hit the cap.
• internal/queue/dlq_replay_cap_test.go — three race-safe tests: bounded attempts (cap=10/total=50), unlimited default (cap=0/total=25 → 25 attempts), negative input clamps to unlimited.
• internal/config/config.go — DLQMaxReplayPerTick field, DLQ_MAX_REPLAY_PER_TICK env, default 100.
• main.go — DLQ metrics goroutine wired to appCtx/bootWG, AI service aiCtx/SetParentContext/aiCancel plumbing, dlq.SetMaxReplayPerTick(cfg.DLQMaxReplayPerTick) after construction.

Test plan

• go test ./internal/queue/ ./internal/ai/ ./internal/config/ -race — 45 passed
• go test ./... (full suite, no race) — 459 passed in 27 packages
• go vet ./... — clean
• go build ./... — clean
• CI green (security stack + SonarCloud) before merge

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud