fix: add 30s timeout to PB HTTP client; halve heartbeat tick interval

- storage/pocketbase.go: replace http.DefaultClient (no timeout) with a
  dedicated pbHTTPClient{Timeout: 30s} so a slow/hung PocketBase cannot
  stall the backend or runner indefinitely
- runner/asynq_runner.go: heartbeat ticker was firing at StaleTaskThreshold
  (2 min) == the Docker healthcheck deadline, so a single missed tick would
  mark the container unhealthy; halved to StaleTaskThreshold/2 (1 min)

backend/internal/storage/pocketbase.go

@@ -26,6 +26,11 @@ import (
 // ErrNotFound is returned by single-record lookups when no record exists.
 var ErrNotFound = errors.New("storage: record not found")
 
+// pbHTTPClient is a shared HTTP client with a 30 s timeout so that a slow or
+// hung PocketBase never stalls the backend/runner process indefinitely.
+// http.DefaultClient has no timeout and must not be used for PocketBase calls.
+var pbHTTPClient = &http.Client{Timeout: 30 * time.Second}
+
 // pbClient is the internal PocketBase REST admin client.
 type pbClient struct {
 	baseURL  string
@@ -66,7 +71,7 @@ func (c *pbClient) authToken(ctx context.Context) (string, error) {
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := pbHTTPClient.Do(req)
 	if err != nil {
 		return "", fmt.Errorf("pb auth: %w", err)
 	}
@@ -104,7 +109,7 @@ func (c *pbClient) do(ctx context.Context, method, path string, body io.Reader)
 		req.Header.Set("Content-Type", "application/json")
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := pbHTTPClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("pb: %s %s: %w", method, path, err)
 	}