fix(worker): 限制大图归一化峰值内存

6K 多参考图在 P24 下会并发进入高内存缩放并击穿 2 GiB Worker。新增独立可配置的图片归一化并发，生产默认 2，只约束解码、缩放和重编码阶段，不占用视频上游等待槽；缩放器改为内存稳定的近似双线性实现。\n\n验证：6K 到 6000x2400 转换、信号量串行化、Go 全量测试、gofmt、Kubernetes 客户端 dry-run。

apps/api/internal/runner/service.go

@@ -47,6 +47,7 @@ type Service struct {
 	admissionListener      sync.Once
 	asyncClientFactory     func(int) (asyncExecutionClient, error)
 	mediaResultSlots       chan struct{}
+	imageNormalizeSlots    chan struct{}
 	directOSS              *directOSSUploader
 	taskCompletionOnce     sync.Once
 	taskCompletionMu       sync.Mutex
@@ -130,6 +131,9 @@ func NewWithStores(
 	if cfg.MediaMaterializationConcurrency == 0 {
 		cfg.MediaMaterializationConcurrency = 8
 	}
+	if cfg.MediaImageNormalizationConcurrency == 0 {
+		cfg.MediaImageNormalizationConcurrency = 2
+	}
 	if cfg.TaskProgressCallbackTimeoutMS == 0 {
 		cfg.TaskProgressCallbackTimeoutMS = 5000
 	}
@@ -184,6 +188,7 @@ func NewWithStores(
 		asyncAdmissionWake:     make(chan struct{}, 1),
 		admissionTaskWaiters:   map[string]*admissionTaskWaiter{},
 		mediaResultSlots:       make(chan struct{}, cfg.MediaMaterializationConcurrency),
+		imageNormalizeSlots:    make(chan struct{}, cfg.MediaImageNormalizationConcurrency),
 		directOSS:              newDirectOSSUploader(cfg),
 		taskCompletionWaiters:  map[string]map[chan struct{}]struct{}{},
 		taskCompletionPollWake: make(chan struct{}, 1),