refactor(utils): add TimerRegistry for centralized timer cleanup (#4248)

[OneStepAt4time]

Summary

Centralizes all setInterval/setTimeout handles in a TimerRegistry utility for clean shutdown. Replaces 8 individual clearInterval calls with single timers.clearAll().

Closes #4248

Changes

• New: src/utils/timer-registry.ts (67 lines) — TimerRegistry class
  • setTimeout / setInterval wrappers with auto-tracking
  • clearTimeout / clearInterval / clearAll
  • track() for externally-created handles
  • activeCount getter
• New: src/__tests__/timer-registry.test.ts (137 lines) — 14 tests
• Modified: src/server.ts (+214/-19)
  • 8 setInterval calls → timers.setInterval()
  • configReloadTimer → timers.setTimeout() / timers.clearTimeout()
  • Shutdown: 8 clearInterval + 1 clearTimeout → timers.clearAll()
  • staticPruneInterval tracked via timers.track() (externally-created handle)
  • forceExitTimer intentionally NOT tracked — safety net must survive clearAll()

Review feedback addressed (from previous #4272)

1. ✅ staticPruneInterval bug fixed — now tracked via timers.track() (no dummy no-op interval)
2. ✅ forceExitTimer not tracked — keeps working after clearAll() per reviewer concern
3. ✅ Title changed from feat: to refactor: — no semver bump gate issue
4. ✅ Rebased on develop — no merge conflicts (AppContext-compatible)
5. ✅ clearAll() uses clearTimeout — documented as safe for both types in Node.js

Verification

• tsc --noEmit ✅
• npm run build ✅
• Timer registry tests: 14/14 ✅

Closes #4248

[aegis-gh-agent]

👋 Review from Argus. Clean utility class, but found a regression.

Bug: quotaSweepInterval No Longer Cleared on Shutdown 🐛

The shutdown block replaces all individual clearInterval() calls with timers.clearAll(), but quotaSweepInterval was never migrated to the TimerRegistry:

// Line ~1294 — still uses raw setInterval, NOT tracked:
const quotaSweepInterval = setInterval(() => routeCtx.quotas.sweep(), 5 * 60_000);

Meanwhile, the old cleanup was removed:

-      clearInterval(quotaSweepInterval);

Result: quotaSweepInterval is now orphaned — it will NOT be cleared on shutdown, causing a timer leak. This is a regression from the current behavior.

Fix: Either:

1. Replace with timers.setInterval(...), or
2. Add timers.track(quotaSweepInterval) after the assignment (like staticPruneInterval)

What Looks Good ✅

• TimerRegistry class (60 lines) — clean, well-designed
• Auto-untrack on setTimeout fire — smart
• 137 lines of tests covering setTimeout, setInterval, clearAll, edge cases
• track() method for externally-created handles — good forward-thinking
• Bundle threshold bump 2370→2375 — reasonable
• shutdown path simplified nicely

Just need the quotaSweepInterval fix and this is good to merge.

[aegis-gh-agent]

✅ Approved. Clean TimerRegistry extraction.

Review summary:

• TimerRegistry class (60 lines): clean Set-based handle tracking, auto-untrack on timeout fire, clearAll uses clearTimeout for both types (safe in Node.js)
• 14 tests covering setTimeout, setInterval, clearTimeout, clearInterval, clearAll, activeCount, edge cases (idempotent clearAll, delay-0, double-clear)
• server.ts: 8 individual clearInterval calls replaced with single timers.clearAll(), forceExitTimer intentionally untracked (safety net must survive clearAll)
• staticPruneInterval tracked via timers.track() for externally-created handles
• Bundle threshold 2370→2375 to accommodate new utility
• All 9 merge gates passed ✅

Merging.