fix(queue): raise River JobTimeout for large-document ingest (#50)

* fix(queue): raise River JobTimeout so large-document ingest completes

River's client JobTimeout defaults to 1 minute, which cancels the ingest
job mid-flight on large documents: summarize + HyDE + ToC issue one LLM
call per section, and a 100+ section document needs far longer than 60s
(it was failing with repeated 'context deadline exceeded' and retrying).

Add a configurable RiverConfig.JobTimeout with a generous 30-minute
default and pass it to the River client, so full-document summarization
runs to completion.

* chore(deps): bump golang.org/x/image to v0.43.0 (fixes GO-2026-5061)

Resolves the govulncheck finding: a webp alpha-channel panic in
golang.org/x/image reachable via the PDF parser's image support.

Author: hallelx2

go.mod

@@ -29,7 +29,7 @@ require (
 	go.opentelemetry.io/otel/sdk v1.43.0
 	go.opentelemetry.io/otel/trace v1.43.0
 	golang.org/x/net v0.55.0
-	golang.org/x/sync v0.20.0
+	golang.org/x/sync v0.21.0
 	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/yaml.v3 v3.0.1
@@ -121,10 +121,10 @@ require (
 	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
 	go.uber.org/goleak v1.3.0 // indirect
 	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/image v0.39.0 // indirect
+	golang.org/x/image v0.43.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect

go.sum

@@ -259,18 +259,18 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
 golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/image v0.39.0 h1:skVYidAEVKgn8lZ602XO75asgXBgLj9G/FE3RbuPFww=
-golang.org/x/image v0.39.0/go.mod h1:sIbmppfU+xFLPIG0FoVUTvyBMmgng1/XAMhQ2ft0hpA=
+golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
+golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=

pkg/queue/river.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"sync"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -22,6 +23,13 @@ type RiverConfig struct {
 
 	// NumWorkers is the max concurrent jobs drained from the default queue.
 	NumWorkers int
+
+	// JobTimeout bounds how long a single job may run before River cancels
+	// its context. River's own default is just 1 minute — far too short for
+	// full-document ingest, where summarize + HyDE + ToC issue one LLM call
+	// per section and a large document has hundreds. Zero applies a generous
+	// default (see NewRiver).
+	JobTimeout time.Duration
 }
 
 // River is a Postgres-backed Queue using https://github.com/riverqueue/river.
@@ -107,6 +115,12 @@ func NewRiver(cfg RiverConfig) (*River, error) {
 	if cfg.NumWorkers <= 0 {
 		cfg.NumWorkers = 10
 	}
+	if cfg.JobTimeout <= 0 {
+		// Large documents (100+ sections) need well over River's 1-minute
+		// default to finish every per-section LLM summary. 30 minutes is a
+		// safe ceiling that still guards against a genuinely wedged job.
+		cfg.JobTimeout = 30 * time.Minute
+	}
 
 	// We open the pool eagerly so NewRiver surfaces DB misconfiguration at
 	// boot rather than on the first enqueue. The pool is closed by Close().
@@ -219,6 +233,7 @@ func (r *River) ensureClient() error {
 			Queues: map[string]river.QueueConfig{
 				river.QueueDefault: {MaxWorkers: r.cfg.NumWorkers},
 			},
+			JobTimeout: r.cfg.JobTimeout,
 		})
 		if err != nil {
 			r.initEr = fmt.Errorf("river: new client: %w", err)