fix(publish): prevent stuck publish queue and duplicate posting

The desktop publish queue could stall for a long time and end users assumed
the software was broken. Root cause: a hung adapter held its execution slot
with no wall-clock timeout while auto-renewing its lease forever, so the
server never reclaimed it and every queued task behind it stayed 等待发布.
Auto-recovery also risked silently re-posting a non-idempotent article.

Client (Electron):
- per-task wall-clock deadline + abort; progress-gated lease renewal that
  stops and aborts a stalled task instead of renewing it forever
- decouple the concurrency cap from CDP-induced CPU/memory pressure
  (admission gate instead of self-throttling collapse); 15s watchdog pump
- all adapter network I/O now has fetch timeouts and honors context.signal;
  bounded image-upload concurrency with per-image timeout
- surface live adapter progress, elapsed time, queue position and a
  working-vs-queued distinction in the publish view

Server (tenant-api):
- publish lease-recovery worker (every 3m) + supporting index: reclaim
  expired in_progress publish leases, requeue (<3 attempts) or terminal-fail
- 3-minute lease TTL with client-presence-gated extension; max 3 attempts

Idempotency (production-grade core):
- durable publish_submit_started_at marker, set before the irreversible
  platform submit POST; recovery and abort route a maybe-submitted task to
  unknown (manual reconcile, kept in the dedup set) instead of re-posting
- desktop UI requires explicit confirmation before retrying a possibly-
  already-published task

Verified: go build/vet/test (incl. resolvePublishRecoveryOutcome), vue-tsc,
vitest 141/141, gofmt all clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/scheduler/publish_lease_recovery_worker.go

@@ -0,0 +1,114 @@
+package scheduler
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+
+	tenantapp "github.com/geo-platform/tenant-api/internal/tenant/app"
+)
+
+const (
+	defaultPublishLeaseRecoveryInterval = 3 * time.Minute
+	defaultPublishLeaseRecoveryTimeout  = 30 * time.Second
+	defaultPublishLeaseRecoveryLimit    = 1000
+)
+
+type PublishLeaseRecoveryWorker struct {
+	service  *tenantapp.DesktopTaskService
+	logger   *zap.Logger
+	interval time.Duration
+	timeout  time.Duration
+	limit    int
+}
+
+func NewPublishLeaseRecoveryWorker(service *tenantapp.DesktopTaskService, logger *zap.Logger) *PublishLeaseRecoveryWorker {
+	return &PublishLeaseRecoveryWorker{
+		service:  service,
+		logger:   logger,
+		interval: defaultPublishLeaseRecoveryInterval,
+		timeout:  defaultPublishLeaseRecoveryTimeout,
+		limit:    defaultPublishLeaseRecoveryLimit,
+	}
+}
+
+func (w *PublishLeaseRecoveryWorker) Start(ctx context.Context) {
+	go w.Run(ctx)
+}
+
+func (w *PublishLeaseRecoveryWorker) Run(ctx context.Context) {
+	if w == nil || w.service == nil {
+		return
+	}
+	w.run(ctx)
+}
+
+func (w *PublishLeaseRecoveryWorker) run(ctx context.Context) {
+	w.runOnce(context.Background())
+
+	ticker := time.NewTicker(w.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			w.runOnce(context.Background())
+		}
+	}
+}
+
+func (w *PublishLeaseRecoveryWorker) runOnce(parent context.Context) {
+	ctx, cancel := context.WithTimeout(parent, w.timeout)
+	defer cancel()
+
+	result, err := w.service.RecoverExpiredPublishTasks(ctx, w.limit)
+	if err != nil {
+		if w.logger != nil {
+			w.logger.Warn("publish lease recovery failed", zap.Error(err))
+		}
+		return
+	}
+
+	if (result.Requeued > 0 || result.Failed > 0 || result.Uncertain > 0) && w.logger != nil {
+		w.logger.Info("publish lease recovery completed",
+			zap.Int("requeued_task_count", result.Requeued),
+			zap.Int("failed_task_count", result.Failed),
+			zap.Int("uncertain_task_count", result.Uncertain),
+		)
+	}
+}
+
+func (w *PublishLeaseRecoveryWorker) RunOnce(parent context.Context, run JobRunContext) (map[string]any, error) {
+	if w == nil || w.service == nil {
+		return map[string]any{"skipped": true, "reason": "worker_not_ready"}, nil
+	}
+	startedAt := time.Now()
+	timeout := w.timeout
+	if run.Job != nil && run.Job.TimeoutSeconds > 0 {
+		timeout = time.Duration(run.Job.TimeoutSeconds) * time.Second
+	}
+	limit := w.limit
+	if run.Job != nil && run.Job.BatchSize != nil && *run.Job.BatchSize > 0 {
+		limit = *run.Job.BatchSize
+	}
+	if value := AsInt(run.Config, "batch_size", 0); value > 0 && (run.Job == nil || run.Job.BatchSize == nil) {
+		limit = value
+	}
+	ctx, cancel := context.WithTimeout(parent, timeout)
+	defer cancel()
+
+	result, err := w.service.RecoverExpiredPublishTasks(ctx, limit)
+	if err != nil {
+		return map[string]any{"stage": "recover"}, err
+	}
+	return map[string]any{
+		"requeued_task_count":  result.Requeued,
+		"failed_task_count":    result.Failed,
+		"uncertain_task_count": result.Uncertain,
+		"duration_ms":          time.Since(startedAt).Milliseconds(),
+		"batch_size":           limit,
+	}, nil
+}