fix(video): enforce one absolute deadline for streaming frame decode

[lstein]

Summary

Follow-on to #9163 (deferred non-merge-blocker).

iter_video_frames charged its timeout twice:

1. it waited up to timeout to acquire the stream slot and a decoder slot, then
2. handed _iter_video_frames_unbounded a fresh full timeout for the first frame.

So a caller that waited 29 s for capacity and then hit a hung decoder blocked for ~59 s — twice the bound it believed it was enforcing. Both callers size real budgets on that value: upload probing (which runs on a request worker) and the video nodes.

_run_worker already had the right shape for the one-shot path — take a deadline up front, and pass the remaining time to the worker after acquiring the slot. This applies the same pattern to the streaming path.

Why the first frame only

timeout in the streaming decoder is a decoder-inactivity bound, not a total wall-clock budget: it is restarted after every yielded frame so a long video isn't killed for being long. Shrinking it for all frames (the naive "pass remaining through") would mean a decode that queued 29 s for a slot then got 1 s per frame — spurious failures on perfectly good videos.

So _iter_video_frames_unbounded gains an optional first_frame_timeout that overrides the budget for the first frame only. Post-first-frame behavior is unchanged.

Testing

New regression test test_capacity_wait_and_first_frame_share_one_deadline: holds the single stream slot for 1.6 s of a 2.0 s budget, then releases it against a worker that never produces a frame, and asserts the total stays under one budget plus jitter. Verified it fails on main (~3.6 s, the old hold + timeout) and passes with the fix.

pytest tests/app/util/test_video_thumbnails.py — 54 passed.

🤖 Generated with Claude Code

[JPPhoto]

LGTM! Other findings/issues that may be covered in related PRs (I haven't yet gotten to them) follow. If you don't have PRs for these, I suggest making them:

• invokeai/app/util/video_thumbnails.py:296,369: Relative remainder is converted into a new deadline after worker startup, so slow startup can exceed the promised single timeout. Test: delay worker startup after near-expired capacity wait and assert total time stays within the original deadline.

• tests/app/util/test_video_thumbnails.py:308-319: Unsynchronized sleep can release the slot before the consumer starts, causing a flaky false failure. Test: synchronize at semaphore acquisition before starting the hold timer.