fix(pipeline): harden upstream resilience and production shutdown

DoH через DoWithRetry; CDN preview через UpstreamHTTPDo; частичный fail CDN (EVOBGP_CDN_PARTIAL_OK); безопасный доступ к Job.Meta; drain jobs при SIGTERM; ValidateProductionEnforce при EVOBGP_PRODUCTION=1.

Co-authored-by: Cursor <[email protected]>

cmd/evobgp-all/main.go

@@ -29,6 +29,9 @@ func main() {
 		os.Exit(dbcli.Run(os.Args[2:]))
 	}
 	cfg := config.Load()
+	if err := config.ValidateProductionEnforce(); err != nil {
+		log.Fatal(err)
+	}
 	opts := httpapi.Options{
 		APIKeys:                 os.Getenv("EVOBGP_API_KEYS"),
 		DatabaseURL:             cfg.DatabaseURL,
@@ -86,6 +89,13 @@ func main() {
 	<-ctx.Done()
 	shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
+	n := srv.Jobs().RequestCancelAll()
+	if n > 0 {
+		log.Printf("draining %d job(s)…", n)
+		if err := srv.Jobs().Drain(shutdownCtx); err != nil {
+			log.Printf("job drain: %v", err)
+		}
+	}
 	if err := httpSrv.Shutdown(shutdownCtx); err != nil {
 		log.Printf("HTTP shutdown: %v", err)
 	}

cmd/evobgp-api/main.go

@@ -24,6 +24,9 @@ func main() {
 		os.Exit(dbcli.Run(os.Args[2:]))
 	}
 	cfg := config.Load()
+	if err := config.ValidateProductionEnforce(); err != nil {
+		log.Fatal(err)
+	}
 	seedDemo := os.Getenv("EVOBGP_SEED_DEMO") != "0"
 	opts := httpapi.Options{
 		APIKeys:            os.Getenv("EVOBGP_API_KEYS"),
@@ -78,6 +81,13 @@ func main() {
 	<-ctx.Done()
 	shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
+	n := srv.Jobs().RequestCancelAll()
+	if n > 0 {
+		log.Printf("draining %d job(s)…", n)
+		if err := srv.Jobs().Drain(shutdownCtx); err != nil {
+			log.Printf("job drain: %v", err)
+		}
+	}
 	if err := httpSrv.Shutdown(shutdownCtx); err != nil {
 		log.Printf("HTTP shutdown: %v", err)
 	}