fix(mollifier): bound drainer shutdown so a hung handler can't block exit

Pass a configurable timeout to drainer.stop() so SIGTERM/SIGINT can't hang
forever if an in-flight handler is wedged. Matches the precedent set by
BATCH_TRIGGER_WORKER_SHUTDOWN_TIMEOUT_MS (default 30s).

Author: d-cs

apps/webapp/app/env.server.ts

@@ -1057,6 +1057,7 @@ const EnvironmentSchema = z
     MOLLIFIER_DRAIN_CONCURRENCY: z.coerce.number().int().positive().default(50),
     MOLLIFIER_ENTRY_TTL_S: z.coerce.number().int().positive().default(600),
     MOLLIFIER_DRAIN_MAX_ATTEMPTS: z.coerce.number().int().positive().default(3),
+    MOLLIFIER_DRAIN_SHUTDOWN_TIMEOUT_MS: z.coerce.number().int().positive().default(30_000),
 
     BATCH_TRIGGER_PROCESS_JOB_VISIBILITY_TIMEOUT_MS: z.coerce
       .number()

apps/webapp/app/services/worker.server.ts

@@ -149,10 +149,16 @@ export async function init() {
       // without a process-global guard, dev hot-reloads would stack a fresh
       // listener pair every request. Mirrors the `__worker__` singleton
       // pattern above.
+      // Bound shutdown so a hung handler can't block process exit past the
+      // pod's termination grace period. `drainer.stop({ timeoutMs })` logs a
+      // warning and returns if the deadline is hit while a handler is still
+      // in flight.
       const stopDrainer = () => {
-        drainer.stop().catch((error) => {
-          logger.error("Failed to stop mollifier drainer", { error });
-        });
+        drainer
+          .stop({ timeoutMs: env.MOLLIFIER_DRAIN_SHUTDOWN_TIMEOUT_MS })
+          .catch((error) => {
+            logger.error("Failed to stop mollifier drainer", { error });
+          });
       };
       process.once("SIGTERM", stopDrainer);
       process.once("SIGINT", stopDrainer);