reliability: add claim recovery, retries, and dead letters

[PeterGuy326]

Summary

• replace non-atomic queue transitions with Redis Lua contracts for enqueue, claim, acknowledge, retry, release, and replay
• add timestamped dispatch leases, bounded exponential backoff, retry budgets, and a queryable generation-safe dead-letter queue
• preserve active task-id idempotency across legacy waiting/running data and late check/expire responses
• expose authenticated DLQ query/replay APIs through the hardened dashboard proxy
• document configuration, failure semantics, upgrade behavior, and operator workflows

Reliability and compatibility

• acknowledged long-running tasks are not reclaimed by the dispatch lease
• expired pending claims consume the same retry budget as callback failures
• legacy waiting migration is FIFO-preserving, bounded to 1,000 entries per tick, and steady-state enqueue remains O(1)
• bounded running HSCAN supplies grace leases without per-tick full hash scans
• stale claim tokens and stale DLQ entry generations cannot mutate a newer task generation

Verification

• WAITQUEUE_REDIS_INTEGRATION_URL=redis://127.0.0.1:36379/15 pnpm test — 65/65, including real Redis 7 dual-client and migration/ABA cases
• dashboard pnpm typecheck && pnpm build
• production dependency audits for backend and dashboard — no known vulnerabilities
• Compose build/health plus runtime failure → retry → DLQ → replay → stale-generation rejection smoke
• Compose config, workflow YAML, ShellCheck, and git diff --check

Closes #4