fix: recover zombie processing jobs and mark failed jobs properly

People background task could leave jobs stuck in "processing" status
forever when processJob fails or writeGate deadlocks, because:
1. processJob error path never updated job status (only logged)
2. No runtime mechanism to detect stale processing jobs (only startup)
3. No panic recovery around writeGate.RLock areas

Changes:
- Add RecoverStaleProcessing to reset local processing jobs older than
  30min back to queued, called in runBackground when no jobs are found
- Add markJobFailed to set job=failed and reset photo face status on
  processJob error, preventing permanent "processing" state
- Add panic recovery around writeGate.RLock/processJob and
  processPendingFaces to prevent RLock leaks on panic

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: davidhoo

backend/internal/repository/people_job_repo.go

@@ -34,6 +34,10 @@ type PeopleJobRepository interface {
 	HeartbeatRemote(id uint, workerID string, progress int, statusMsg string, lockUntil time.Time) error
 	ReleaseRemote(id uint, workerID string, reason string, retryLater bool) error
 	CompleteRemote(id uint, workerID string) error
+
+	// RecoverStaleProcessing resets local processing jobs that have been running
+	// longer than timeout back to queued, so they can be reclaimed.
+	RecoverStaleProcessing(timeout time.Duration) (int, error)
 }
 
 type peopleJobRepository struct {
@@ -348,3 +352,21 @@ func (r *peopleJobRepository) CompleteRemote(id uint, workerID string) error {
 	}
 	return nil
 }
+
+// RecoverStaleProcessing resets local processing jobs that have been running
+// longer than timeout back to queued, so they can be reclaimed by ClaimNextJob.
+func (r *peopleJobRepository) RecoverStaleProcessing(timeout time.Duration) (int, error) {
+	cutoff := time.Now().Add(-timeout)
+	result := r.db.Model(&model.PeopleJob{}).
+		Where("status = ? AND (worker_id = ? OR worker_id IS NULL) AND started_at < ?",
+			model.PeopleJobStatusProcessing, "", cutoff).
+		Updates(map[string]interface{}{
+			"status":         model.PeopleJobStatusQueued,
+			"started_at":     nil,
+			"status_message": "recovered from stale processing",
+		})
+	if result.Error != nil {
+		return 0, result.Error
+	}
+	return int(result.RowsAffected), nil
+}

backend/internal/service/people_service.go

@@ -972,11 +972,19 @@ func (s *peopleService) runBackground(active *activePeopleTask) {
 				fmt.Sprintf("正在处理照片 #%d", job.PhotoID), &job.PhotoID)
 			s.setBackgroundBusy(true)
 			s.writeGate.RLock()
-			err = s.processJob(job)
+			err = func() (retErr error) {
+				defer func() {
+					if r := recover(); r != nil {
+						retErr = fmt.Errorf("processJob panic: %v", r)
+					}
+				}()
+				return s.processJob(job)
+			}()
 			s.writeGate.RUnlock()
 			s.setBackgroundBusy(false)
 			if err != nil {
 				s.appendBackgroundLog(fmt.Sprintf("处理人物任务 %d 失败：%v", job.ID, err))
+				s.markJobFailed(job.ID, job.PhotoID, err.Error())
 			}
 
 			s.taskMutex.Lock()
@@ -988,6 +996,15 @@ func (s *peopleService) runBackground(active *activePeopleTask) {
 			continue
 		}
 
+		// No detection job — recover stale processing jobs before clustering.
+		recovered, recoverErr := s.jobRepo.RecoverStaleProcessing(30 * time.Minute)
+		if recoverErr != nil {
+			s.appendBackgroundLog(fmt.Sprintf("恢复超时任务失败：%v", recoverErr))
+		} else if recovered > 0 {
+			s.appendBackgroundLog(fmt.Sprintf("已恢复 %d 个超时的检测任务", recovered))
+			continue // re-check ClaimNextJob immediately
+		}
+
 		// No detection job — check for processable pending faces and cluster.
 		// Use ListPending (same query as inner loop) to avoid mismatch with
 		// GetPendingStats which doesn't apply backoff filtering.
@@ -1023,7 +1040,14 @@ func (s *peopleService) runBackground(active *activePeopleTask) {
 
 			s.setBackgroundBusy(true)
 			s.writeGate.RLock()
-			hasMore, clusterErr := s.processPendingFaces()
+			hasMore, clusterErr := func() (hm bool, ce error) {
+				defer func() {
+					if r := recover(); r != nil {
+						ce = fmt.Errorf("processPendingFaces panic: %v", r)
+					}
+				}()
+				return s.processPendingFaces()
+			}()
 			s.writeGate.RUnlock()
 			s.setBackgroundBusy(false)
 			if clusterErr != nil {
@@ -1053,6 +1077,28 @@ func (s *peopleService) runBackground(active *activePeopleTask) {
 	}
 
 }
+
+// markJobFailed marks a processing job as failed and resets the photo's
+// face_process_status so it can be re-enqueued later.
+func (s *peopleService) markJobFailed(jobID uint, photoID uint, errMsg string) {
+	now := time.Now()
+	s.executeWrite(func() error {
+		return s.db.Transaction(func(tx *gorm.DB) error {
+			if err := tx.Model(&model.PeopleJob{}).Where("id = ? AND status = ?", jobID, model.PeopleJobStatusProcessing).
+				Updates(map[string]interface{}{
+					"status":       model.PeopleJobStatusFailed,
+					"last_error":   errMsg,
+					"completed_at": &now,
+				}).Error; err != nil {
+				return err
+			}
+			return tx.Model(&model.Photo{}).Where("id = ? AND face_process_status IN ?",
+				photoID, []string{model.FaceProcessStatusPending, model.FaceProcessStatusProcessing}).
+				Update("face_process_status", model.FaceProcessStatusNone).Error
+		})
+	})
+}
+
 func (s *peopleService) processJob(job *model.PeopleJob) error {
 	photo, skip, err := s.preflightCheck(job)
 	if err != nil {