feat(worker): Phase 2C — Worker scaffold (claim, heartbeat, retry)

[smallchungus]

Summary

Phase 2C: the unit that ties store + queue together.

• internal/worker: pure helpers (Compute exponential backoff with jitter, NewWorkerID, Handler interface, NoopHandler) plus the Worker itself with ProcessOne and Run.
• Worker.ProcessOne: pop job ID -> claim in PG -> spawn heartbeat goroutine -> run handler -> mark done or mark failed (with backoff-computed next_run_at).
• internal/queue: adds Heartbeat(workerID, ttl) writer and Client() accessor (sweeper reader lands in 2D).
• cmd/worker: single binary, --stage=<name> flag, slog JSON, graceful shutdown verified by smoke run.

9 new tests (4 worker unit subgroups + 3 ProcessOne integration + 1 heartbeat integration + 1 queue heartbeat). All integration tests use real Postgres + Redis via testcontainers-go.

Real fetch/render/upload handlers come in Phase 3. Sweeper for orphaned jobs is Phase 2D.

Test plan

• make lint (0 issues, gosec G404 silenced on backoff jitter with rationale)
• make test-unit
• make test-integration (api, queue, store, testutil, worker — all green)
• make k8s-validate (8/8 valid)
• cmd/worker smoke run with docker compose stack — starts and shuts down on SIGTERM cleanly
• CI green