perf(queue): 限制大媒体任务内存并消除准入惊群

将同步与异步非文本任务的准入唤醒改为按任务和全局队首推进，批量续租等待者，避免大量请求同时争抢 advisory lock 和数据库连接。

对 Base64 请求解析、素材解码、上游媒体执行和结果物化增加分层并发限制，复用请求素材并释放重复 Gemini wire 数据；生产 API 默认入口解析并发 16，媒体物化并发 8。

新增 1000 个同步 Gemini 图像编辑请求的模拟上游压力验收，10 MiB 输入和输出下全部成功，Heap 峰值增长约 2.58 GiB，并验证共享上传哈希、单次 attempt 与本地零落盘。

验证：go test ./... -count=1；go vet ./...；gofmt -l 无输出；kubectl kustomize deploy/kubernetes/production；10 MiB Gemini Base64 千任务压力测试通过。

apps/api/internal/httpapi/server.go

@@ -32,6 +32,10 @@ type Server struct {
 	runner                     *runner.Service
 	logger                     *slog.Logger
 	geminiUploadSessions       sync.Map
+	requestAssetLocksMu        sync.Mutex
+	requestAssetLocks          map[string]*requestAssetLock
+	mediaRequestSlots          chan struct{}
+	mediaRequestBodySlots      chan struct{}
 	securityEventReceiver      http.Handler
 	securityEventManager       *ssfreceiver.ConnectionManager
 	identityRuntime            *identityruntime.Manager
@@ -68,16 +72,25 @@ func NewServer(cfg config.Config, db *store.Store, logger *slog.Logger) http.Han
 }
 
 func NewServerWithContext(ctx context.Context, cfg config.Config, db *store.Store, logger *slog.Logger) http.Handler {
+	if cfg.MediaMaterializationConcurrency == 0 {
+		cfg.MediaMaterializationConcurrency = 8
+	}
+	if cfg.MediaRequestConcurrency == 0 {
+		cfg.MediaRequestConcurrency = 16
+	}
 	securityEventMetrics := &ssfreceiver.Metrics{}
 	server := &Server{
-		ctx:              ctx,
-		cfg:              cfg,
-		store:            db,
-		oidcUserResolver: db,
-		auth:             auth.New(cfg.JWTSecret, cfg.ServerMainBaseURL, cfg.ServerMainInternalToken),
-		runner:           runner.New(cfg, db, logger, securityEventMetrics),
-		logger:           logger,
-		billingMetrics:   securityEventMetrics,
+		ctx:                   ctx,
+		cfg:                   cfg,
+		store:                 db,
+		oidcUserResolver:      db,
+		auth:                  auth.New(cfg.JWTSecret, cfg.ServerMainBaseURL, cfg.ServerMainInternalToken),
+		runner:                runner.New(cfg, db, logger, securityEventMetrics),
+		logger:                logger,
+		billingMetrics:        securityEventMetrics,
+		requestAssetLocks:     map[string]*requestAssetLock{},
+		mediaRequestSlots:     make(chan struct{}, cfg.MediaMaterializationConcurrency),
+		mediaRequestBodySlots: make(chan struct{}, cfg.MediaRequestConcurrency),
 	}
 	server.auth.ServerMainInternalKey = cfg.ServerMainInternalKey
 	server.auth.ServerMainInternalSecret = cfg.ServerMainInternalSecret