fix(settings): fall back to computed drain default on malformed SHUTDOWN_DRAIN_MS

[pedrofrxncx]

Follows the same config-hardening lane as #5173 (NODE_ENV) and #5130 (DUCKDB_THREADS): resolveShutdownDrainMs in apps/api/src/settings/resolve-config.ts passed SHUTDOWN_DRAIN_MS straight through Number() with no validation.

Why this matters: the function's own comment explains the drain exists to outlast NLB ip-target deregistration during rollout and avoid CF 520s on in-flight connections. A malformed override (typo, bad env injection, e.g. SHUTDOWN_DRAIN_MS=abc or a negative value) becomes NaN/negative, and the shared sleep()/delay() helper (packages/shared/src/std/delay.ts) silently collapses any NaN or negative delay to 0ms — silently skipping the drain instead of erroring, reintroducing the exact 520 failure mode the drain was added to prevent.

Fix: an invalid override now falls back to the computed per-role default (0 for worker, ~60% of the force-exit budget otherwise) instead of silently becoming a 0ms no-op drain.

Regression test: added two cases to the existing resolveShutdownDrainMs describe block in resolve-config.test.ts — a non-numeric string and a negative number both now resolve to the computed default instead of 0.

Reviewer command: bun test apps/api/src/settings/resolve-config.test.ts

Checks run locally: bun run fmt, bunx tsc --noEmit in apps/api, and the targeted test file above (42 pass). Full CI validates the rest.

---

Summary by cubic

Ensure the shutdown drain isn’t skipped when SHUTDOWN_DRAIN_MS is malformed by falling back to a computed default instead of passing through a bad Number() result. This keeps drains active during rollouts and helps avoid CF 520s.

• Bug Fixes
  • Validate SHUTDOWN_DRAIN_MS and only accept finite, non-negative values; otherwise use the per-role default (worker: 0ms, others: ~60% of force-exit).
  • Added tests for non-numeric and negative overrides in resolveShutdownDrainMs.

^{Written for commit 0d4bd8a. Summary will update on new commits.}