fix(resilience): stop unbounded queue that hangs 6min until Aborted

[maxmad64bis]

⚠️ base-red inherited: #12732

Summary

• fix(resilience): stop unbounded queue that hangs 6min until Aborted — one per-connection maxWaitMs budget shared across gate + provider-default slot + Bottleneck queue (fail-closed 503); executionMaxWaitMs per-connection with max(perConn, upstream) so it never kills a mid-flight request. Builds on the need surfaced in feat(rate-limit): raise per-connection maxWaitMs cap from 2min to 10m… #12635 — keeps @Tushar49's insight (slow providers need 2min→10min per-connection headroom) and adds the missing plumbing (#12635 blocked by h "audio-transcriptions" typo; a ceiling bump alone does not bound the wait). feat(rate-limit): raise per-connection maxWaitMs cap from 2min to 10m… #12635 stays open for its author (with thanks to @Tushar49).

Related Issues

• Related to feat(rate-limit): raise per-connection maxWaitMs cap from 2min to 10m… #12635

Validation

• Change type: other
• Focused tests and category gates from the golden path
• npm run lint — targeted eslint on the touched files is clean; the full run is red on the base (🔴 Release branch not green: release/v3.8.51 #12732), so the box stays unchecked.
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Focused suites, all green on this branch after the change: rate-limit-remaining-budget (5/5), rate-limit-manager-queue-bound (4/4), rate-limit-execution-per-conn (4/4), plus the rate-limit-execution-timeout-message-4165 + provider-rate-limit-overrides-schema companions (25/25). No VPS gate applies — it's local queue/budget plumbing exercised by unit tests, no upstream round-trip involved.

Tests Added Or Updated

• tests/unit/rate-limit-remaining-budget.test.ts — shared budget gate+slot+queue (remaining propagates, 503 on exhaust).
• tests/unit/rate-limit-manager-queue-bound.test.ts — bounded Bottleneck queue with anti-orphan guard remaining<=0 not queued, abort vs timeout distinct).
• tests/unit/rate-limit-execution-per-conn.test.ts — per-connection executionMaxWaitMs and upstream clamp.
• Focused suite 13/13 across the 3 new files pass, companions 25/25 green.

Coverage Notes

Touches open-sse/handlers/chatCore.ts, open-sse/handlers/chatCore/queueBudget.ts (new), config/quality/file-size-baseline.json, open-sse/services/rateLimitManager.ts, open-sse/services/providerDefaultRateLimit.ts, src/lib/resilience/settings/types.ts, src/shared/validation/schemas/provider.ts.
Covered by the 3 new suites plus rate-limit-execution-timeout-message-4165.test.ts and provider-rate-limit-overrides-schema.test.ts. No file loses coverage.

Reviewer Notes

• Queue time (503 on budget exhaust) vs queue depth (429 on SEMAPHORE_QUEUE_FULL; 504 on execution expiration) intentionally distinct — only bare time-budget timeouts are shaped to legacy 503.
• executionMaxWaitMs is max(perConn, upstream) via opts:{executor,providerSpecificData} passed from handleChatCore to withRateLimit.
• chatCore.ts is a frozen file already at its ceiling. The admission error shaping lives in open-sse/handlers/chatCore/queueBudget.ts; the remaining call-site wiring (+15 lines) is rebaselined in config/quality/file-size-baseline.json with a note, like the existing _rebaseline_* entries. The gate-ordering contract chatcore-hierarchical-admission passes its first case; its second case fails the same way on the base tip.