fix(http): harden thread pool lifecycle

[Fernandez81]

Summary

Make HttpServerThreadPool initialization transactional, reject invalid lifecycle inputs, preserve active workers on duplicate initialization, and drain accepted work safely during shutdown. Add focused lifecycle/rollback coverage for pool and server initialization.

Related issue

Closes #90

Root cause

The pool previously wrote candidate workers directly into live member state, assumed worker indices 0/1/2 existed without enforcing a minimum size, and did not fully guard null/throwing dispatcher factories or duplicate initialization.

Scope

In scope

• Validate thread count, server pointer, dispatcher factory, and dispatcher results.
• Build and start all workers transactionally before publishing the pool.
• Make shutdown idempotent and use actual worker-vector bounds.
• Preserve priority routing and public method signatures.
• Roll back HTTP event resources after dispatcher construction/copy failures.
• Add thread-pool and server lifecycle tests.

Out of scope

• File transfer, multipart behavior, HttpPost, MsgThread, or util::Thread.
• HTTP protocol/response changes and public type renames.

Risk tags

• Runtime / lifecycle
• Thread / memory safety
• API / authentication / network
• Media / streaming
• Model / inference / flow
• Frontend console
• Build / package / deployment
• Compatibility / migration
• None of the above

Type of change

• Bug fix
• Feature
• Documentation
• Build / deployment
• Refactor
• Test

Area

• Backend service
• Frontend web console
• Pipeline / scenario configuration
• Model import / model runtime
• API / MQTT / WebSocket
• Media / streaming
• Build / deployment
• Documentation

Candidate identity

• Base commit: 17cdd2e39f8ecc1164db986cd2c8e6f0a10cc393
• Candidate commit: 7f6348e46d0bb76fd790c05efdff6e550afac8da
• Candidate tree: 8899be440e83fdfa38f100b3090ceb852140c1f9
• Package SHA-256: d7021b10edb8f919445725704cd5eb1a8a85dbea3435aea507dae9cab1489485
• Test binary SHA-256: 9ac2c4e833dc6be26f46147567e1cabc9a7a6b6383ef6416fe06b1b76b06dcd8

The candidate was not amended, rebased, merged, or changed after evidence collection.

Verification

Parent baseline

BLOCKED for exact regression attribution: the parent does not contain the new fault-injection cases.
Base identity and pre-change failure paths are recorded in #90.

Candidate checks

PASS clang-format 18.1.3 read-only check on all 4 changed files
PASS git diff --check
PASS cppcheck on all 4 changed files; only 3 existing warnings outside changed lines
PASS docker-compose -f docker-compose.sophon.yml run --rm cosmo-sophon-package
PASS cosmo-tests "[http-server][thread-pool]" — 5 cases, 112 assertions
PASS cosmo-tests "[http-server][lifecycle]" — 6 cases, 122 assertions
PASS cosmo-tests "[http-server][thread]" — 2 cases, 18 assertions
PASS default cosmo-tests — 884 cases: 883 passed, 1 declared host-backed-frame skip; 11872/11872 assertions passed
PASS hidden network — 2/2 cases, 2/2 assertions
PASS hidden device excluding WatchDogService — 20/20 cases, 88/88 assertions
N/A WatchDogService hidden start/stop — separate L3 required-for-release window, not part of this core delivery

Risk-based evidence

• API/network: invalid input, authentication/error routing, same-port retry, event-thread shutdown, and thread-pool lifecycle tests passed.
• Media/streaming: not changed.
• Sophon/device: validated on an authorized BM1688/aarch64 device using the packaged runtime.
• Frontend/UI: not changed.
• Package/deployment: candidate engine SHA-256 4f21dfa754d8ac2760579469bc794ee96812aa7fe2592c79f46d5ac07d8bf716; matching Guard SHA-256 05ea6d203f1ec536b638d6467ffc61eb44c9bbf0494696482c6d9010f53d7b6d.

Real deployment smoke:

1. Engine-only compatibility probe correctly exposed the device old-Guard ABI mismatch; the original engine was immediately restored.
2. Engine and matching Guard from the same candidate package were deployed with independent backups.
3. First startup reached active; root page and anonymous Probe returned HTTP 200 through direct and nginx paths with baseline-identical response hashes.
4. Graceful stop closed ports 80/8000 in about 1.52 seconds; logs confirmed MsgHanderThread_0 through _3 stopped.
5. Second startup reached active, NRestarts=0, started all four handlers, and repeated direct/proxy HTTP 200 responses with no fatal startup log.
6. Second graceful stop again logged all four handler exits. Original engine and Guard link were restored; service returned to active, NRestarts=0, baseline hashes and HTTP responses matched, and boot ID was unchanged.

Documentation impact

• Documentation was updated.
• Documentation is not needed for this internal lifecycle correction.
• Documentation will be handled in a follow-up.

Compatibility and deployment impact

• This change is backward compatible.
• This change may affect public APIs, configuration files, pipelines, deployment scripts, or model artifacts.
• Not applicable.

Third-party code and assets

• This PR does not add third-party code, models, datasets, media, or generated assets.
• This PR adds third-party materials, and their source and license are documented.
• This PR does not include GPL, AGPL, or other strong copyleft code.

Security and release checklist

• No secrets, tokens, private keys, or certificates are included.
• No real device SN values, customer names, or private IPs are included.
• No private model weights or proprietary download links are included.
• No new dependencies were added.
• Documentation impact was reviewed.
• The commit is signed off.
• CONTRIBUTING.md and CODE_OF_CONDUCT.md requirements were followed.

Acceptance and cleanup

• Candidate-bound acceptance: 验证通过 7f6348e46d0bb76fd790c05efdff6e550afac8da d7021b10edb8f919445725704cd5eb1a8a85dbea3435aea507dae9cab1489485
• Device test filter: default + [.network]~[device] + [.device]~[WatchDogService]
• Device backup state: restored and temporary backups removed
• Temporary-data cleanup: complete; uploaded tests/runtime and run directory removed
• Final Git status: clean
• Evidence was collected from the candidate commit listed above.
• No source change occurred after validation.
• No temporary credentials, media, models, device exports, or generated packages are included.

Notes for reviewers

util::Thread::start() registration behavior on a low-level std::thread construction exception remains explicitly out of scope. The pool structure still rolls back every worker object it owns.

[Fernandez81]

远端 CI 已全部通过：build-and-test、cppcheck、docs、format-check、frontend-build、policy-audit、validation-tools 均为 PASS。

本地/设备证据和回滚状态见 PR 描述。当前只剩候选绑定确认：

验证通过 7f6348e46d0bb76fd790c05efdff6e550afac8da d7021b10edb8f919445725704cd5eb1a8a85dbea3435aea507dae9cab1489485

[Fernandez81]

候选绑定验收已收到：

验证通过 7f6348e46d0bb76fd790c05efdff6e550afac8da d7021b10edb8f919445725704cd5eb1a8a85dbea3435aea507dae9cab1489485

该验收对应 PR 当前 head 7f6348e46d0bb76fd790c05efdff6e550afac8da，未发生 amend、rebase、merge 或源码变更。