perf(queue): 限制大媒体任务内存并消除准入惊群

将同步与异步非文本任务的准入唤醒改为按任务和全局队首推进，批量续租等待者，避免大量请求同时争抢 advisory lock 和数据库连接。

对 Base64 请求解析、素材解码、上游媒体执行和结果物化增加分层并发限制，复用请求素材并释放重复 Gemini wire 数据；生产 API 默认入口解析并发 16，媒体物化并发 8。

新增 1000 个同步 Gemini 图像编辑请求的模拟上游压力验收，10 MiB 输入和输出下全部成功，Heap 峰值增长约 2.58 GiB，并验证共享上传哈希、单次 attempt 与本地零落盘。

验证：go test ./... -count=1；go vet ./...；gofmt -l 无输出；kubectl kustomize deploy/kubernetes/production；10 MiB Gemini Base64 千任务压力测试通过。

apps/api/internal/runner/proxy.go

@@ -21,6 +21,11 @@ type httpClientCache struct {
 
 const providerHTTPClientTimeout = 10 * time.Minute
 
+const (
+	providerHTTPMaxIdleConnections        = 2048
+	providerHTTPMaxIdleConnectionsPerHost = 1024
+)
+
 func newHTTPClientCache() *httpClientCache {
 	return &httpClientCache{
 		none:   newHTTPClient(nil),
@@ -68,6 +73,12 @@ func (c *httpClientCache) customClient(rawProxy string) (*http.Client, error) {
 func newHTTPClient(proxy func(*http.Request) (*url.URL, error)) *http.Client {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	transport.Proxy = proxy
+	// Media workers may keep hundreds of slow upstream tasks in flight and
+	// poll the same provider repeatedly. The standard library only retains two
+	// idle connections per host, which turns a high-concurrency polling load
+	// into avoidable TCP/TLS handshakes.
+	transport.MaxIdleConns = providerHTTPMaxIdleConnections
+	transport.MaxIdleConnsPerHost = providerHTTPMaxIdleConnectionsPerHost
 	return &http.Client{
 		Timeout:   providerHTTPClientTimeout,
 		Transport: transport,