fix(worker): 防止事务泄漏并恢复滞留队列

为 PostgreSQL 连接增加可配置的事务空闲与锁等待超时，并在请求取消或 Worker 退出后使用独立有界上下文回滚事务。\n\n恢复过期任务时按批次使用 SKIP LOCKED，周期重建缺失或终态 River Job；锁等待超时只在确认尚未提交上游时安全重排，避免重复执行和重复结算。\n\n验证：完整 Go 测试、go vet、生产 Kustomize 渲染、gofmt 与 git diff --check 均通过。

apps/api/internal/store/identity_configurations.go

@@ -59,7 +59,7 @@ func (s *Store) beginIdentityConfigurationLifecycleTx(ctx context.Context) (pgx.
 		return nil, err
 	}
 	if err := lockIdentityConfigurationLifecycle(ctx, tx); err != nil {
-		_ = tx.Rollback(ctx)
+		rollbackTransaction(tx)
 		return nil, err
 	}
 	return tx, nil
@@ -171,7 +171,7 @@ func (s *Store) ApplyIdentityManifest(ctx context.Context, id string, expectedVe
 	if err != nil {
 		return identity.Revision{}, err
 	}
-	defer tx.Rollback(ctx)
+	defer rollbackTransaction(tx)
 	current, err := scanIdentityRevision(tx.QueryRow(ctx, `SELECT `+identityRevisionColumns+`
 FROM gateway_identity_configuration_revisions WHERE id=$1::uuid FOR UPDATE`, id))
 	if err != nil {
@@ -282,7 +282,7 @@ func (s *Store) ActivateIdentityRevision(ctx context.Context, id string, expecte
 	if err != nil {
 		return identity.Revision{}, false, err
 	}
-	defer tx.Rollback(ctx)
+	defer rollbackTransaction(tx)
 	var foreignPairingReservation bool
 	if err := tx.QueryRow(ctx, `SELECT EXISTS(
   SELECT 1 FROM gateway_identity_pairing_start_reservation
@@ -364,7 +364,7 @@ func (s *Store) DisableActiveIdentityRevision(ctx context.Context, expectedVersi
 	if err != nil {
 		return identity.Revision{}, err
 	}
-	defer tx.Rollback(ctx)
+	defer rollbackTransaction(tx)
 	if ok, err := hasBreakGlassManager(ctx, tx); err != nil {
 		return identity.Revision{}, err
 	} else if !ok {