fix: staging CI triage — consolidate retry parsing, fix flaky tests, add docs (#1427)

* fix: consolidate retry-after parsing and fix flaky OAuth env tests (#1288, #1280)

- Extract shared `parse_retry_after()` into `src/llm/retry.rs` supporting
  both delay-seconds and RFC2822 formats, replacing duplicated inline parsing
  in anthropic_oauth.rs, nearai_chat.rs, and embeddings.rs
- Fix flaky `bind_rejects_wildcard_*` tests in oauth_helpers.rs by adding
  `tokio::sync::Mutex` to serialize env var access (matching the ENV_MUTEX
  pattern in oauth_defaults.rs)
- Add regression tests for parse_retry_after edge cases

Closes #1288, #1280

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* docs: add comments explaining CLI_ENABLED=false in service templates (#990)

Clarify that CLI_ENABLED=false is needed in daemon mode (launchd/systemd)
to prevent blocking on stdin when running as a background service.

Closes #990

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix: address review comments on retry-after consolidation

- Change parse_retry_after() return type from Option<Duration> to Duration
  (it never returns None due to the 60s fallback)
- Fix doc comment: reference RFC 7231 §7.1.1 for HTTP-date, not RFC 2822
- Add parse_retry_after_http_date test for the RFC 2822 date parsing branch
- Remove stale per-file test helpers (parse_retry_after_*_for_test) that
  duplicated old inline logic instead of testing the shared function
- Remove unnecessary comments above #[cfg(test)] imports
- Use crate-wide ENV_MUTEX instead of local tokio::sync::Mutex in
  oauth_helpers tests to prevent cross-module env-var races

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix: reword await_holding_lock safety comment

Drop runtime-flavor assumption; justify by short-lived awaited operation.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>

src/workspace/embeddings.rs

@@ -6,8 +6,6 @@
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 
-use crate::llm::retry::cap_retry_after;
-
 /// Error type for embedding operations.
 #[derive(Debug, thiserror::Error)]
 pub enum EmbeddingError {
@@ -228,14 +226,9 @@ impl EmbeddingProvider for OpenAiEmbeddings {
         }
 
         if status == reqwest::StatusCode::TOO_MANY_REQUESTS {
-            let retry_after = response
-                .headers()
-                .get("retry-after")
-                .and_then(|v| v.to_str().ok())
-                .and_then(|s| s.parse::<u64>().ok())
-                .map(std::time::Duration::from_secs)
-                .map(cap_retry_after)
-                .or(Some(std::time::Duration::from_secs(60)));
+            let retry_after = Some(crate::llm::retry::parse_retry_after(
+                response.headers().get("retry-after"),
+            ));
             return Err(EmbeddingError::RateLimited { retry_after });
         }
 
@@ -371,14 +364,9 @@ impl EmbeddingProvider for NearAiEmbeddings {
         }
 
         if status == reqwest::StatusCode::TOO_MANY_REQUESTS {
-            let retry_after = response
-                .headers()
-                .get("retry-after")
-                .and_then(|v| v.to_str().ok())
-                .and_then(|s| s.parse::<u64>().ok())
-                .map(std::time::Duration::from_secs)
-                .map(cap_retry_after)
-                .or(Some(std::time::Duration::from_secs(60)));
+            let retry_after = Some(crate::llm::retry::parse_retry_after(
+                response.headers().get("retry-after"),
+            ));
             return Err(EmbeddingError::RateLimited { retry_after });
         }
 
@@ -652,49 +640,4 @@ mod tests {
         let provider = OpenAiEmbeddings::new("test-key").with_base_url("custom.example.com/v1");
         assert_eq!(provider.base_url, "https://custom.example.com/v1");
     }
-
-    // -- Retry-After header parsing tests (regression for rate limit "None" bug) --
-
-    #[test]
-    fn test_retry_after_parsing_delay_seconds() {
-        // Verify delay-seconds format is parsed correctly
-        let header_value = "120";
-        let duration = parse_retry_after_embeddings_for_test(header_value);
-        assert_eq!(
-            duration,
-            Some(std::time::Duration::from_secs(120)),
-            "Should parse delay-seconds format"
-        );
-    }
-
-    #[test]
-    fn test_retry_after_fallback_missing_header() {
-        // Regression test: When Retry-After header is missing,
-        // should fall back to 60s instead of None
-        let duration = parse_retry_after_embeddings_for_test("");
-        assert_eq!(
-            duration,
-            Some(std::time::Duration::from_secs(60)),
-            "Missing header should fallback to 60s"
-        );
-    }
-
-    #[test]
-    fn test_retry_after_zero_seconds_accepted() {
-        // Verify zero seconds is a valid retry delay
-        let duration = parse_retry_after_embeddings_for_test("0");
-        assert_eq!(duration, Some(std::time::Duration::ZERO));
-    }
-
-    /// Helper function to test Retry-After header parsing logic for embeddings
-    /// (simulates the parsing done in embed without actual HTTP, including fallback)
-    fn parse_retry_after_embeddings_for_test(header_value: &str) -> Option<std::time::Duration> {
-        header_value
-            .trim()
-            .parse::<u64>()
-            .ok()
-            .map(std::time::Duration::from_secs)
-            .map(cap_retry_after)
-            .or(Some(std::time::Duration::from_secs(60)))
-    }
 }