backend: harden rootless app lifecycle orchestration

scripts/fix-indeedhub-containers.sh

@@ -10,6 +10,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 # This script: stops broken containers, removes them, recreates with correct images.
 
 echo "=== IndeedHub Container Fix Script ==="
+PODMAN_IMAGE_CHECK_TIMEOUT="${PODMAN_IMAGE_CHECK_TIMEOUT:-10}"
 
 # Detect node IP (Tailscale or LAN)
 NODE_IP=$(hostname -I | awk '{for(i=1;i<=NF;i++) if($i ~ /^100\./) print $i}')
@@ -29,7 +30,7 @@ fi
 # Verify correct images are available
 echo "Verifying images..."
 for img in "${INDEEDHUB_REDIS_IMAGE}" "${MINIO_IMAGE}" "${INDEEDHUB_POSTGRES_IMAGE}" "${NOSTR_RS_RELAY_IMAGE}" "${SEARXNG_IMAGE}" "localhost/indeedhub:local" "localhost/indeedhub-build_api:local" "localhost/indeedhub-build_ffmpeg-worker:local"; do
-  if ! podman image exists "$img" 2>/dev/null; then
+  if ! timeout --kill-after=2s "${PODMAN_IMAGE_CHECK_TIMEOUT}s" podman image exists "$img" 2>/dev/null; then
     echo "ERROR: Missing image $img"
     exit 1
   fi