fix(admission): 限制媒体任务准入锁等待并发

媒体请求从认证、任务创建到异步准入登记共用可配置的请求并发令牌，完成登记后立即释放。这样仍会尽早丢弃 Base64 正文，但不会让高并发请求各占一个 PostgreSQL 连接等待 advisory lock。\n\n扩展 Gemini 双角色压力测试，使用生产同档 API/Worker 连接池并记录数据库连接与 advisory lock 峰值。\n\n验证：go test ./... -count=1；go vet ./...；pnpm openapi；迁移安全检查；256 个 256 KiB 异步 Gemini 请求全部通过，连接峰值 45、锁等待峰值 14。

apps/api/internal/httpapi/handlers.go

@@ -1074,6 +1074,15 @@ func (s *Server) listModelRateLimitStatuses(w http.ResponseWriter, r *http.Reque
 // @Router /api/v1/reranks [post]
 func (s *Server) createTask(kind string, compatible bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var releaseAsyncMediaRequest func()
+		if easyAIAsyncMediaRequest(kind, r) {
+			var err error
+			releaseAsyncMediaRequest, err = s.acquireMediaRequestBodySlot(r.Context())
+			if err != nil {
+				return
+			}
+			defer releaseAsyncMediaRequest()
+		}
 		targetProtocol := targetProtocolForTaskRequest(kind, r)
 		writeTaskError := func(status int, message string, details map[string]any, codes ...string) {
 			if easyAIAsyncMediaRequest(kind, r) {
@@ -1230,6 +1239,10 @@ func (s *Server) createTask(kind string, compatible bool) http.Handler {
 				writeTaskError(statusFromRunError(err), runErrorMessage(err), runErrorDetails(err), runErrorCode(err))
 				return
 			}
+			if releaseAsyncMediaRequest != nil {
+				releaseAsyncMediaRequest()
+				releaseAsyncMediaRequest = nil
+			}
 			writeTaskAccepted(w, task)
 			return
 		}