fix: add 30s timeout to PB HTTP client; halve heartbeat tick interval

- storage/pocketbase.go: replace http.DefaultClient (no timeout) with a
  dedicated pbHTTPClient{Timeout: 30s} so a slow/hung PocketBase cannot
  stall the backend or runner indefinitely
- runner/asynq_runner.go: heartbeat ticker was firing at StaleTaskThreshold
  (2 min) == the Docker healthcheck deadline, so a single missed tick would
  mark the container unhealthy; halved to StaleTaskThreshold/2 (1 min)

.gitea/workflows/ci.yaml

@@ -2,11 +2,8 @@ name: CI
 
 on:
   push:
-    paths:
-      - "backend/**"
-      - "ui/**"
-      - ".gitea/workflows/ci.yaml"
-  pull_request:
+    tags-ignore:
+      - "v*"
     paths:
       - "backend/**"
       - "ui/**"

backend/internal/runner/asynq_runner.go

@@ -78,7 +78,7 @@ func (r *Runner) runAsynq(ctx context.Context) error {
 	// Write /tmp/runner.alive every 30s so Docker healthcheck passes in asynq mode.
 	// This mirrors the heartbeat file behavior from the poll() loop.
 	go func() {
-		heartbeatTick := time.NewTicker(r.cfg.StaleTaskThreshold)
+		heartbeatTick := time.NewTicker(r.cfg.StaleTaskThreshold / 2)
 		defer heartbeatTick.Stop()
 		for {
 			select {

backend/internal/storage/pocketbase.go

@@ -26,6 +26,11 @@ import (
 // ErrNotFound is returned by single-record lookups when no record exists.
 var ErrNotFound = errors.New("storage: record not found")
 
+// pbHTTPClient is a shared HTTP client with a 30 s timeout so that a slow or
+// hung PocketBase never stalls the backend/runner process indefinitely.
+// http.DefaultClient has no timeout and must not be used for PocketBase calls.
+var pbHTTPClient = &http.Client{Timeout: 30 * time.Second}
+
 // pbClient is the internal PocketBase REST admin client.
 type pbClient struct {
 	baseURL  string
@@ -66,7 +71,7 @@ func (c *pbClient) authToken(ctx context.Context) (string, error) {
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := pbHTTPClient.Do(req)
 	if err != nil {
 		return "", fmt.Errorf("pb auth: %w", err)
 	}
@@ -104,7 +109,7 @@ func (c *pbClient) do(ctx context.Context, method, path string, body io.Reader)
 		req.Header.Set("Content-Type", "application/json")
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := pbHTTPClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("pb: %s %s: %w", method, path, err)
 	}

scripts/pb-init-v3.sh

@@ -259,6 +259,14 @@ create "translation_jobs" '{
     {"name":"heartbeat_at", "type":"date"}
   ]}'
 
+create "discovery_votes" '{
+  "name":"discovery_votes","type":"base","fields":[
+    {"name":"session_id","type":"text","required":true},
+    {"name":"user_id",   "type":"text"},
+    {"name":"slug",      "type":"text","required":true},
+    {"name":"action",    "type":"text","required":true}
+  ]}'
+
 # ── 5. Field migrations (idempotent — adds fields missing from older installs) ─
 add_field "scraping_tasks" "heartbeat_at"           "date"
 add_field "audio_jobs"     "heartbeat_at"           "date"

ui/src/routes/discover/+page.svelte

@@ -114,7 +114,7 @@
 	);
 	const rotation = $derived(isDragging ? Math.max(-18, Math.min(18, offsetX / 12)) : 0);
 
-	let cardEl: HTMLDivElement | null = null;
+	let cardEl = $state<HTMLDivElement | null>(null);
 
 	function onPointerDown(e: PointerEvent) {
 		if (animating || !currentBook) return;
@@ -446,6 +446,7 @@
 			{/if}
 
 			<!-- Active card -->
+			{#if currentBook}
 			<div
 				bind:this={cardEl}
 				class="absolute inset-0 rounded-2xl overflow-hidden shadow-2xl cursor-grab active:cursor-grabbing z-10"
@@ -522,6 +523,7 @@
 					<span class="text-(--color-muted) font-black text-lg tracking-widest">NOPE</span>
 				</div>
 			</div>
+			{/if}
 		</div>
 
 		<!-- Action buttons -->