fix(purchase): run execution and terminal save outside the 30s HTTP request context #706

Summary

Synchronous purchase execution runs on the 30s HTTP request context, and the terminal status save uses the same context. If the request is cancelled mid-purchase, the cloud purchase may have succeeded but the final state is never written ("AUDIT LOSS"). There is no stuck-purchase reaper on GCP or Azure.

Where

At commit b50ca38:

• internal/server/http.go:234
• internal/purchase/manager.go:220-249

Failure scenario

A purchase takes longer than 30s, or the client disconnects. The context is cancelled after the provider call returned but before the terminal save, so the execution stays non-terminal while the commitment exists. On GCP and Azure nothing reaps it, and a retry can buy again. Found by source reading; not reproduced live.

Suggested fix

Run the purchase and its terminal save under context.WithoutCancel with its own timeout, or return 202 and execute asynchronously. Wait for in-flight executions on SIGTERM.

Severity

High: a completed purchase can be left unrecorded, which loses the audit trail and invites a double buy.

Related: #105, #258, #664 (related, but not the synchronous purchase path).

Reviewer ID: MON-10 (ops H3)
Found by the 2026-10-08 review fleet.