fix(ops): bound logs, drain ffmpeg's stderr, and stop three silent hangs

Six independent operational defects, none of which needed a new feature to fix.

Log rotation. Docker's json-file driver is unbounded by default, and those files
land on the HOST filesystem — outside every deploy.resources.limits in the compose
file, and on the same disk as postgres_data and media_data. A full disk stops
Postgres writing WAL, which takes the event down. Capped at 10m x 3 per service.

Log level. RUST_LOG was set in neither .env.example nor docker-compose.yml, so the
code fallback WAS the production level — and it was `debug`, with tower_http=debug
emitting a line per request and per response into that unrotated file. Now info,
with tower_http=warn to state that those spans are diagnostics, not an access log.

ffmpeg pipe deadlock. run_ffmpeg piped stdout and stderr and then called wait(),
which drains neither. Once the ~64 KiB pipe buffer filled, ffmpeg blocked writing
and wait() never returned — burning the full 120s timeout, twice per seek position,
three times per compression attempt. And the timeout is an Err, so the end state was
a soft-deleted upload: a guest's playable video destroyed by a poster-frame failure.
Now stdout is null (nothing ever read it) and stderr is drained by wait_with_output,
whose tail is logged on a non-zero exit. Note wait_with_output consumes the child, so
the old kill-on-timeout is gone; kill_on_drop(true) already covers it.

Readiness probe. /health never touched the pool, so the disk-full endgame above
stayed green all the way down. Adds /health/ready (SELECT 1 under 2s) as a SECOND
route — the compose healthcheck deliberately keeps pointing at /health, because
caddy gates its startup on it and a DB-dependent probe would turn a Postgres blip
into the reverse proxy refusing to start.

api.ts request timeout. The abort timer was cleared in a finally around fetch(),
which resolves on the response HEAD — leaving res.text() uncovered and no longer
abortable. An upstream that sends headers then stalls the body hung the call
forever. The timer now lives until the body is read, including the 204 path (which
otherwise leaked a live 20s timer per no-content request).

Upload XHR watchdog. The XHR had no timeout while processQueue held the
isProcessing latch across it; on a half-open socket neither error nor abort ever
fires, so the latch pinned and the queue wedged. Bounds SILENCE rather than total
duration — a 500 MB video over a venue uplink legitimately runs 30+ minutes while
making steady progress. Rejects as NetworkError, which is already the retryable
branch, so a stalled upload now recovers like any network blip.

IndexedDB failures. addToQueue called getDb() unguarded and handleSubmit had no
catch, so a private-mode refusal or a QuotaExceededError on a large blob left a
permanent "Wird hochgeladen…" spinner, no toast, and — for an in-app camera
capture — the only copy of the photo gone. Now reported as 'failed', which keeps
the staged files on screen and stays on the page.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -27,6 +27,13 @@ async function request<T>(method: string, path: string, body?: unknown): Promise
 
 	// Abort hung requests so a dead connection surfaces as a friendly error
 	// instead of a spinner that never resolves.
+	//
+	// The timer must stay armed until the BODY has been read, not just the headers.
+	// `fetch` resolves as soon as the response head arrives, so clearing it in a `finally`
+	// around the fetch left `res.text()` below completely uncovered — and no longer
+	// abortable, since the controller had already been disarmed. An upstream that sends
+	// headers and then stalls the body (the shape of a half-dead proxy, or of the pool
+	// saturation this same release adds shedding for) hung that call forever.
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
 
@@ -38,6 +45,26 @@ async function request<T>(method: string, path: string, body?: unknown): Promise
 			body: body !== undefined ? JSON.stringify(body) : undefined,
 			signal: controller.signal
 		});
+	} catch (e) {
+		clearTimeout(timer);
+		if (e instanceof DOMException && e.name === 'AbortError') {
+			throw new ApiError(0, 'timeout', 'Zeitüberschreitung – bitte erneut versuchen.');
+		}
+		throw new ApiError(0, 'network', 'Netzwerkfehler – bitte Verbindung prüfen.');
+	}
+
+	if (res.status === 204) {
+		// Must clear on this path too, or every no-content request (logout, delete, like)
+		// leaks a live 20 s timer.
+		clearTimeout(timer);
+		return undefined as T;
+	}
+
+	// A 5xx behind a proxy (or a crash page) can return HTML, not JSON — parsing
+	// it directly would throw an opaque SyntaxError. Read text, parse defensively.
+	let raw: string;
+	try {
+		raw = await res.text();
 	} catch (e) {
 		if (e instanceof DOMException && e.name === 'AbortError') {
 			throw new ApiError(0, 'timeout', 'Zeitüberschreitung – bitte erneut versuchen.');
@@ -47,13 +74,6 @@ async function request<T>(method: string, path: string, body?: unknown): Promise
 		clearTimeout(timer);
 	}
 
-	if (res.status === 204) {
-		return undefined as T;
-	}
-
-	// A 5xx behind a proxy (or a crash page) can return HTML, not JSON — parsing
-	// it directly would throw an opaque SyntaxError. Read text, parse defensively.
-	const raw = await res.text();
 	let data: { error?: string; message?: string } | unknown = null;
 	if (raw) {
 		try {