fix(jobs): stop JobQueueService leaking unhandled rejections on DB errors

[ersinkoc]

Summary

Found during a proactive concurrency audit of JobQueueService.

The service invokes executeJob and pollWorker fire-and-forget from three callsites, but only pollAll isolated rejections (via Promise.allSettled). The gaps:

• executeJob caught the job handler's errors but awaited repo.complete / repo.fail unguarded — both are DB writes that can throw on a transient connection loss.
• pollWorker rejects if repo.claimJob throws, and the immediate-start poll (startWorker) and per-job re-poll (.finally) didn't .catch it.

So a transient DB failure while finalizing or claiming a job surfaced as an unhandled promise rejection. The gateway's global handler only logs (no crash), but it emitted a misleading Unhandled Promise Rejection with no job/worker context — a false crash signal.

That pollAll already used allSettled while the sibling callsites didn't is the tell this was an oversight, not intent.

Fix

• executeJob wraps repo.fail in its own try/catch → it never rejects; the caller's finally still frees the slot.
• New private safePoll() wrapper catches pollWorker rejections at the two bare callsites (immediate start poll + per-job re-poll). pollAll is unchanged.

Behavior is otherwise identical — the worker frees the slot and re-polls in every path; this only stops the leaked rejection.

Test plan

4 new regression tests in job-queue-service.test.ts:

1. executeJob resolves (not rejects) when repo.complete throws, and still calls repo.fail for retry.
2. executeJob resolves when repo.complete and repo.fail both throw.
3. The slot is freed via finally when the job's persistence throws.
4. startWorker's immediate poll emits no unhandledRejection when claimJob throws (process listener assertion).

• ✅ 6/6 tests pass (2 existing + 4 new), no type errors
• ✅ typecheck + eslint clean

🤖 Generated with Claude Code