fix(postgres): per-connection timeouts so a wedged index can't stall the store

[localai-bot]

Problem

A corrupt custom-index access method (observed: a BM25 index from pg_textsearch left inconsistent by a past pg_resetwal) can make an INSERT spin indefinitely on a BufferContent LWLock. The wedged backend:

• holds its relation lock the whole time, so every later statement on that table queues behind it - one stuck insert silently stalls the entire vector store and saturates the connection pool;
• is uninterruptible - pg_terminate_backend returns true but the backend never dies, so only a Postgres restart clears it (and the next insert re-wedges).

Observed in production: a single 4-day-wedged INSERT with 75 CREATE INDEX IF NOT EXISTS statements queued behind it (LocalRecall re-issues index DDL + inserts on every collection access), connections climbing toward max_connections. pg_buffercache confirmed the only pinned buffer in the instance was in the corrupt bm25 index.

The pool opened connections with no timeouts at all, so nothing bounded the cascade.

Fix

applyConnTimeouts sets safe per-connection timeouts on the pool config before the pool is opened:

Param	Default	Why
lock_timeout	30s	The cascade-killer. Bounds how long a statement waits to acquire a lock, so queued statements fail fast instead of piling up for days. Never interrupts a statement doing real work.
idle_in_transaction_session_timeout	300s	Reaps abandoned transactions that would otherwise pin locks and the xmin horizon.
statement_timeout	unset (opt-in)	Bounds total statement runtime, which also kills the wedged insert itself. Off by default because a large DiskANN/HNSW index build can legitimately exceed any fixed limit.

Index builds run via execNoStatementTimeout (SET LOCAL statement_timeout = 0 in a tx), so operators can safely enable statement_timeout without risking long builds. lock_timeout still applies to builds.

All three are env-overridable; "0"/"off" opts out:

• POSTGRES_LOCK_TIMEOUT
• POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT
• POSTGRES_STATEMENT_TIMEOUT

Tests

New applyConnTimeouts unit specs (Ginkgo, no live DB): defaults, env overrides, 0/off opt-out, nil RuntimeParams. go build ./... and go vet ./rag/engine/ clean.

Follow-ups (separate)

• Pin pg_textsearch to a tagged release in Dockerfile.pgsql (currently an untracked git clone HEAD → the unreproducible 1.0.0-dev).
• Bump the localrecall dependency in LocalAI once merged.