feat(coordinator): running state, worker liveness, request-size limits

Polish pass hardening the queue and closing plan gaps.

- Task state machine gains `running`: the first heartbeat moves a task from
  leased to running (migrations 0006/0007 add the enum value and extend the
  lease-integrity check). verifyLease, ExpireLease, the reaper SQL, and job
  progress all treat leased and running alike.
- Worker liveness: a heartbeat from a registered worker (UUID worker_id) bumps
  its last_heartbeat_at online; a second background reaper marks workers offline
  after WORKER_OFFLINE_AFTER of silence (RunReaper generalized to RunPeriodic).
- Request-size limits: JSON bodies capped at 1 MiB; dataset/artifact uploads
  capped at MAX_UPLOAD_BYTES (default 1 GiB) via http.MaxBytesReader.
- Tests cover the running transition, liveness + offline reaper (unit over
  memstore and integration over Postgres).

coordinator/internal/usecase/job.go

@@ -143,9 +143,10 @@ func progressFrom(job domain.Job, counts map[domain.TaskStatus]int) domain.JobPr
 	p := domain.JobProgress{
 		Job:     job,
 		Pending: counts[domain.TaskPending],
-		Leased:  counts[domain.TaskLeased],
-		Done:    counts[domain.TaskCompleted],
-		Failed:  counts[domain.TaskFailed],
+		// Leased and running are both "in flight" for progress purposes.
+		Leased: counts[domain.TaskLeased] + counts[domain.TaskRunning],
+		Done:   counts[domain.TaskCompleted],
+		Failed: counts[domain.TaskFailed],
 	}
 	for _, n := range counts {
 		p.Total += n