perf(queue): 按策略动态扩缩异步 Worker

将 River 执行容量按平台模型与用户组的有效并发策略动态调整，并为长任务续租、并发租约原子抢占和限流退避补充保护。\n\n统一平台模型限流继承语义，兼容历史 platformLimits/modelLimits，并为三个迁移图像模型建立独立并发租约。补充管理端显式继承/覆盖配置、指标、单元测试及隔离 PostgreSQL 验收。\n\n验证：go test ./... -count=1；pnpm lint；pnpm test；pnpm build；隔离 PostgreSQL 并发原子性/续租测试；128 任务与三分钟长任务动态 Worker 验收。

apps/api/internal/securityevents/metrics_test.go

@@ -26,6 +26,10 @@ func TestMetricsExposeBoundedOutcomesAndState(t *testing.T) {
 	metrics.ObserveHeartbeat("accepted")
 	metrics.ObserveIntrospection("failed")
 	metrics.ObserveJWKSRefreshFailure("ssf")
+	metrics.SetAsyncWorkerCapacity(96, 128, 96, true)
+	metrics.ObserveAsyncWorkerResize("success")
+	metrics.ObserveConcurrencyLeaseRenewal("success")
+	metrics.ObserveConcurrencyLeaseRenewal("lost")
 
 	recorder := httptest.NewRecorder()
 	metrics.Handler(metricsSnapshot{mode: "push_healthy", last: time.Now().Add(-time.Minute)}, "issuer", "audience", true).
@@ -42,6 +46,12 @@ func TestMetricsExposeBoundedOutcomesAndState(t *testing.T) {
 		`easyai_gateway_ssf_mode{mode="push_healthy"} 1`,
 		`easyai_gateway_oidc_introspection_total{outcome="failed"} 1`,
 		`easyai_gateway_jwks_refresh_failures_total{outcome="ssf"} 1`,
+		`easyai_gateway_async_worker_capacity 96`,
+		`easyai_gateway_async_worker_desired_capacity 128`,
+		`easyai_gateway_async_worker_capacity_capped 1`,
+		`easyai_gateway_async_worker_resizes_total{outcome="success"} 1`,
+		`easyai_gateway_concurrency_lease_renewals_total{outcome="success"} 1`,
+		`easyai_gateway_concurrency_lease_renewals_total{outcome="lost"} 1`,
 	} {
 		if !strings.Contains(recorder.Body.String(), expected) {
 			t.Fatalf("missing metric %q in:\n%s", expected, recorder.Body.String())