Reliable batch jobs

Create one durable record per input with an internal job ID, model ID, payload hash, state, attempt count, and ModelRush request ID. Workers should claim jobs with bounded concurrency.

Retry 429 and transient 5xx responses with jitter. Move validation and billing failures to a review state. For async media, reconcile an existing generation ID before creating a replacement.