perf(queue): 按策略动态扩缩异步 Worker

将 River 执行容量按平台模型与用户组的有效并发策略动态调整，并为长任务续租、并发租约原子抢占和限流退避补充保护。\n\n统一平台模型限流继承语义，兼容历史 platformLimits/modelLimits，并为三个迁移图像模型建立独立并发租约。补充管理端显式继承/覆盖配置、指标、单元测试及隔离 PostgreSQL 验收。\n\n验证：go test ./... -count=1；pnpm lint；pnpm test；pnpm build；隔离 PostgreSQL 并发原子性/续租测试；128 任务与三分钟长任务动态 Worker 验收。

apps/api/internal/securityevents/metrics.go

@@ -44,6 +44,17 @@ type Metrics struct {
 	billingEstimateFailed      atomic.Uint64
 	billingIdempotentReplay    atomic.Uint64
 	billingPricingUnavailable  atomic.Uint64
+	asyncWorkerCapacity        atomic.Int64
+	asyncWorkerDesiredCapacity atomic.Int64
+	asyncWorkerHardLimit       atomic.Int64
+	asyncWorkerCapacityCapped  atomic.Int64
+	asyncWorkerResizeSuccess   atomic.Uint64
+	asyncWorkerRefreshFailed   atomic.Uint64
+	asyncWorkerCreateFailed    atomic.Uint64
+	asyncWorkerStartFailed     atomic.Uint64
+	leaseRenewalSuccess        atomic.Uint64
+	leaseRenewalFailure        atomic.Uint64
+	leaseRenewalLost           atomic.Uint64
 }
 
 var processingDurationBounds = [...]time.Duration{
@@ -123,6 +134,41 @@ func (m *Metrics) ObserveBillingEvent(event string) {
 	}
 }
 
+func (m *Metrics) SetAsyncWorkerCapacity(current, desired, hardLimit int, capped bool) {
+	m.asyncWorkerCapacity.Store(int64(current))
+	m.asyncWorkerDesiredCapacity.Store(int64(desired))
+	m.asyncWorkerHardLimit.Store(int64(hardLimit))
+	cappedValue := int64(0)
+	if capped {
+		cappedValue = 1
+	}
+	m.asyncWorkerCapacityCapped.Store(cappedValue)
+}
+
+func (m *Metrics) ObserveAsyncWorkerResize(outcome string) {
+	switch outcome {
+	case "success":
+		m.asyncWorkerResizeSuccess.Add(1)
+	case "refresh_failed":
+		m.asyncWorkerRefreshFailed.Add(1)
+	case "create_failed":
+		m.asyncWorkerCreateFailed.Add(1)
+	case "start_failed":
+		m.asyncWorkerStartFailed.Add(1)
+	}
+}
+
+func (m *Metrics) ObserveConcurrencyLeaseRenewal(outcome string) {
+	switch outcome {
+	case "success":
+		m.leaseRenewalSuccess.Add(1)
+	case "lost":
+		m.leaseRenewalLost.Add(1)
+	default:
+		m.leaseRenewalFailure.Add(1)
+	}
+}
+
 func (m *Metrics) Handler(provider MetricsSnapshotProvider, issuer, audience string, enabled bool) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		mode := "disabled"
@@ -212,6 +258,21 @@ func (m *Metrics) Handler(provider MetricsSnapshotProvider, issuer, audience str
 		plainCounter(w, "easyai_gateway_billing_estimate_failures_total", "Pricing estimate requests that failed.", m.billingEstimateFailed.Load())
 		plainCounter(w, "easyai_gateway_billing_idempotent_replays_total", "Generation requests replayed idempotently.", m.billingIdempotentReplay.Load())
 		plainCounter(w, "easyai_gateway_billing_pricing_unavailable_total", "Pricing requests rejected because no effective price was available.", m.billingPricingUnavailable.Load())
+		plainGauge(w, "easyai_gateway_async_worker_capacity", "Current River asynchronous worker capacity.", m.asyncWorkerCapacity.Load())
+		plainGauge(w, "easyai_gateway_async_worker_desired_capacity", "Uncapped asynchronous worker capacity derived from model and user-group policies.", m.asyncWorkerDesiredCapacity.Load())
+		plainGauge(w, "easyai_gateway_async_worker_hard_limit", "Per-process asynchronous worker safety limit.", m.asyncWorkerHardLimit.Load())
+		plainGauge(w, "easyai_gateway_async_worker_capacity_capped", "Whether desired asynchronous worker capacity is capped by the hard limit.", m.asyncWorkerCapacityCapped.Load())
+		outcomeCounters(w, "easyai_gateway_async_worker_resizes_total", "Asynchronous worker resize attempts by bounded outcome.", []outcomeValue{
+			{"success", m.asyncWorkerResizeSuccess.Load()},
+			{"refresh_failed", m.asyncWorkerRefreshFailed.Load()},
+			{"create_failed", m.asyncWorkerCreateFailed.Load()},
+			{"start_failed", m.asyncWorkerStartFailed.Load()},
+		})
+		outcomeCounters(w, "easyai_gateway_concurrency_lease_renewals_total", "Concurrency lease renewals by bounded outcome.", []outcomeValue{
+			{"success", m.leaseRenewalSuccess.Load()},
+			{"failure", m.leaseRenewalFailure.Load()},
+			{"lost", m.leaseRenewalLost.Load()},
+		})
 	})
 }
 
@@ -249,3 +310,7 @@ func outcomeCounters(w http.ResponseWriter, name, help string, values []outcomeV
 func plainCounter(w http.ResponseWriter, name, help string, value uint64) {
 	fmt.Fprintf(w, "# HELP %s %s\n# TYPE %s counter\n%s %d\n", name, help, name, name, value)
 }
+
+func plainGauge(w http.ResponseWriter, name, help string, value int64) {
+	fmt.Fprintf(w, "# HELP %s %s\n# TYPE %s gauge\n%s %d\n", name, help, name, name, value)
+}

apps/api/internal/securityevents/metrics_test.go

@@ -26,6 +26,10 @@ func TestMetricsExposeBoundedOutcomesAndState(t *testing.T) {
 	metrics.ObserveHeartbeat("accepted")
 	metrics.ObserveIntrospection("failed")
 	metrics.ObserveJWKSRefreshFailure("ssf")
+	metrics.SetAsyncWorkerCapacity(96, 128, 96, true)
+	metrics.ObserveAsyncWorkerResize("success")
+	metrics.ObserveConcurrencyLeaseRenewal("success")
+	metrics.ObserveConcurrencyLeaseRenewal("lost")
 
 	recorder := httptest.NewRecorder()
 	metrics.Handler(metricsSnapshot{mode: "push_healthy", last: time.Now().Add(-time.Minute)}, "issuer", "audience", true).
@@ -42,6 +46,12 @@ func TestMetricsExposeBoundedOutcomesAndState(t *testing.T) {
 		`easyai_gateway_ssf_mode{mode="push_healthy"} 1`,
 		`easyai_gateway_oidc_introspection_total{outcome="failed"} 1`,
 		`easyai_gateway_jwks_refresh_failures_total{outcome="ssf"} 1`,
+		`easyai_gateway_async_worker_capacity 96`,
+		`easyai_gateway_async_worker_desired_capacity 128`,
+		`easyai_gateway_async_worker_capacity_capped 1`,
+		`easyai_gateway_async_worker_resizes_total{outcome="success"} 1`,
+		`easyai_gateway_concurrency_lease_renewals_total{outcome="success"} 1`,
+		`easyai_gateway_concurrency_lease_renewals_total{outcome="lost"} 1`,
 	} {
 		if !strings.Contains(recorder.Body.String(), expected) {
 			t.Fatalf("missing metric %q in:\n%s", expected, recorder.Body.String())