fix(relay): disk-backed segments, transient-error tolerance, SIGTERM

[Liuhaai]

Summary

Three production resilience issues in trio-relay, fixed together because they touch the same upload loop:

1. Cloud blip = 30-60s of dead air. Previously any non-204 response killed the ffmpeg session and the wrapper script had to respawn. Now classify outcomes as OK/TRANSIENT/FATAL — 5xx and httpx.TransportError are transient (log + skip + continue); only 401/403 abort.
2. Worker pinned at 0% CPU after HTTP error. httpx per-byte timeouts don't fire on a half-closed connection. Wrap each POST in asyncio.wait_for(..., timeout=30s).
3. SIGKILL'd runs leak segment files in /tmp. Production wrapper uses timeout --signal=TERM; CLI only registered SIGINT, so the TemporaryDirectory never unwound. Register SIGTERM, and add a startup sweep that removes trio-relay-segments-* dirs older than 1h.

Bonus correctness changes that fell out of the rewrite:

• Capture and upload run concurrently via asyncio.Queue — slow POST no longer stalls the ffmpeg reader.
• Segments written to disk during capture instead of buffered in memory — bounds memory under upload backpressure.
• httpx upload timeouts bumped 30s → 120s.
• Camera registration no longer leaks RTSP credentials into the registry payload.

Test plan

• 3 new tests for transient/fatal classification (5xx, 401, transport error)
• Upload deadline test with a hung POST
• Concurrent capture/upload test (second segment captured while first POST is in-flight)
• 3 stale-tmpdir sweep tests (removes old, leaves fresh, threshold)
• End-to-end SIGTERM regression test delivers a real signal and asserts teardown fires
• All previous segmented-post tests updated for new disk-backed reader

🤖 Generated with Claude Code