[P1] Harden scheduler, background jobs and lifecycle reliability

[fxbin]

Parent: #2

Context

TopicEye now has substantial lifecycle/concurrency behavior: APScheduler, per-source sync jobs, DB-backed analysis jobs, recovery dispatch, post-sync work, DuckDB initialization/fallback and background cache warmup. This is a high-regression surface even when individual functions look correct.

WorkOrder

Lead: Backend / Architect
Verifier: independent QA/Backend verifier

This is a reliability-hardening work item, not an assertion that every listed path is currently broken.

Audit and test scope

1. Startup/shutdown: migrations, seed steps, DuckDB timeout/degraded mode, scheduler enable/disable, cancellation of background tasks.
2. Scheduler ownership: prove jobs are not duplicated across startup/reload/deployment topologies; document supported worker topology.
3. Source sync lease: claim → commit → ingest → rollback/self-heal behavior under exception, timeout and process interruption.
4. Analysis job recovery: queued/running jobs across restart; idempotency and duplicate-dispatch protection.
5. Post-sync/background tasks: task lifetime, exception collection, bounded concurrency and shutdown behavior.
6. Health semantics: /health/live and /health/ready should reflect documented deployability semantics, including scheduler-disabled configuration and DuckDB fallback.
7. External I/O: timeouts/retries and test isolation; unit tests must not depend on public network unless explicitly marked integration.

Acceptance criteria

• Deterministic tests exist for restart/recovery/idempotency boundaries.
• Supported process/worker topology is documented.
• No unowned create_task path can silently lose exceptions or outlive shutdown without an explicit lifecycle policy.
• Scheduler disabled mode and DuckDB degraded mode have regression coverage.
• External I/O is mocked/faked in unit tests; explicit integration tests are separately marked.
• Any reproduced defect discovered here is split into a dedicated linked bug issue before behavioral code is changed.

Non-goals

• Replacing APScheduler.
• Rewriting the persistence layer.
• Broad performance optimization without measurements.