feat(engine): add opt-in image timeout and scene-paint hedging

IMAGE_TIMEOUT_MS sets a per-attempt hard deadline (AbortSignal.timeout);
IMAGE_HEDGE_MS races a second identical scene-paint request when the
first is still pending past the threshold. Both default to OFF when
unset, preserving historical behavior for self-hosted deploys.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -56,6 +56,22 @@ IMAGE_MODEL=runware:400@6
 # stays fastest + cheapest for the scene-by-scene flow.
 # IMAGE_PROVIDER=runware
 
+# Optional image-latency guards. BOTH default to OFF when unset — leaving
+# them blank keeps the exact historical behavior, so self-hosted deploys are
+# unaffected unless they opt in.
+#   IMAGE_TIMEOUT_MS — per-attempt hard deadline for image requests; a timed
+#     out attempt is retried like a 5xx. Recommended 30000 for Runware
+#     (healthy-day p99 is ~26-37s; Runware's own gateway 504s at ~55s).
+#   IMAGE_HEDGE_MS — scene-paint hedging: if the referenced scene paint has
+#     not finished after this many ms, race a second identical request and
+#     keep whichever finishes first (the loser is aborted, but the provider
+#     may still bill it). Rescues straggler tasks; never fires when the first
+#     attempt already failed (e.g. 429/503 saturation). Recommended 15000 for
+#     Runware (healthy-day p95). Do NOT set thresholds this low for providers
+#     that are normally slow (e.g. gpt-image takes 20-60s per image).
+# IMAGE_TIMEOUT_MS=30000
+# IMAGE_HEDGE_MS=15000
+
 # ---- 3. Vision model · multimodal click interpretation -------------
 # Recommended: MiMo V2.5 — multimodal, accepts image_url content parts.
 VISION_BASE_URL=https://token-plan-sgp.xiaomimimo.com/v1