Add channel highlights generation flow

[idoshamun]

Summary

• add API-side channel highlights persistence, cron, and worker wiring
• generate horizon-bound highlight candidates with collection-first story grouping and lightweight continuity state
• add mocked highlight evaluation plus shadow/publish run tracking and regression coverage for collection upgrades and relation-driven reevaluation

Verification

• pnpm run lint
• pnpm run build
• pnpm run test -- tests/cron/channelHighlights.ts tests/workers/generateChannelHighlight.ts --runInBand

[pulumi]

🍹 The Update (preview) for dailydotdev/api/prod (at eb6d8f5) was successful.

✨ Neo Explanation

This deployment rolls out a new API version with a new "channel highlights" feature (new PubSub subscription + CronJob), runs DB and ClickHouse migrations for the new code, and removes the `GOOGLE_IOS_CLIENT_ID` config from the shared Kubernetes secret — the latter causing a brief secret replacement that could transiently affect pods during the rollout.

Root Cause Analysis

A new code deployment is being rolled out across the entire API stack. The new build introduces a channel highlights feature, which requires new infrastructure (a PubSub subscription, a CronJob, and supporting messaging), alongside the standard deployment of all services to the new image version. Additionally, a Kubernetes secret had a key (GOOGLE_IOS_CLIENT_ID) removed, triggering a secret replacement.

Dependency Chain

1. New image version → all 7 Kubernetes Deployments and all 37 CronJobs are updated to pull the new container image and reflect the new version label.
2. New channel highlights feature → a new GCP PubSub subscription (api.generate-channel-highlight) and a new CronJob (channel-highlights-cron) are created to support the feature end-to-end.
3. Database & ClickHouse migrations → the previous migration Jobs (tied to the old image version) are deleted and replaced with new ones for the new version, running both TypeORM (db-migration) and ClickHouse (clickhouse-migration) schema migrations before the new app code takes over.
4. Secret change → removing GOOGLE_IOS_CLIENT_ID from the Kubernetes secret forces a replace (delete + recreate) of the secret object, which any workload referencing it will pick up on next restart.

Risk Analysis

The Kubernetes secret replacement (vpc-native-k8s-secret) is the only notable risk: there is a brief window during the replace where pods restarting between the delete and recreate could fail to load the secret. The migration jobs run against live databases — if the migrations fail, the new app version (which depends on the updated schema) could malfunction until resolved.

Resource Changes

    Name                                                       Type                                  Operation
+   vpc-native-api-db-migration-986a2549                       kubernetes:batch/v1:Job               create
~   vpc-native-private-deployment                              kubernetes:apps/v1:Deployment         update
~   vpc-native-update-source-tag-view-cron                     kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-analytics-clickhouse-cron          kubernetes:batch/v1:CronJob           update
~   vpc-native-personalized-digest-deployment                  kubernetes:apps/v1:Deployment         update
~   vpc-native-rotate-daily-quests-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-generic-referral-reminder-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-user-profile-analytics-history-clickhouse-cron  kubernetes:batch/v1:CronJob           update
~   vpc-native-update-highlighted-views-cron                   kubernetes:batch/v1:CronJob           update
+   vpc-native-channel-highlights-cron                         kubernetes:batch/v1:CronJob           create
+   api-sub-api.generate-channel-highlight                     gcp:pubsub/subscription:Subscription  create
~   vpc-native-update-source-public-threshold-cron             kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-user-companies-cron                kubernetes:batch/v1:CronJob           update
-   vpc-native-api-db-migration-a8abc537                       kubernetes:batch/v1:Job               delete
-   vpc-native-api-clickhouse-migration-a8abc537               kubernetes:batch/v1:Job               delete
~   vpc-native-update-trending-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-post-analytics-history-day-clickhouse-cron      kubernetes:batch/v1:CronJob           update
~   vpc-native-update-tags-str-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-daily-digest-cron                               kubernetes:batch/v1:CronJob           update
~   vpc-native-rotate-weekly-quests-cron                       kubernetes:batch/v1:CronJob           update
~   vpc-native-hourly-notification-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-post-analytics-clickhouse-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-opportunities-cron                 kubernetes:batch/v1:CronJob           update
~   vpc-native-expire-super-agent-trial-cron                   kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-images-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-update-achievement-rarity-cron                  kubernetes:batch/v1:CronJob           update
~   vpc-native-channel-digests-cron                            kubernetes:batch/v1:CronJob           update
~   vpc-native-update-tag-recommendations-cron                 kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-zombie-users-cron                         kubernetes:batch/v1:CronJob           update
~   vpc-native-personalized-digest-cron                        kubernetes:batch/v1:CronJob           update
~   vpc-native-update-views-cron                               kubernetes:batch/v1:CronJob           update
~   vpc-native-calculate-top-readers-cron                      kubernetes:batch/v1:CronJob           update
~   vpc-native-ws-deployment                                   kubernetes:apps/v1:Deployment         update
~   vpc-native-update-current-streak-cron                      kubernetes:batch/v1:CronJob           update
+   vpc-native-api-clickhouse-migration-986a2549               kubernetes:batch/v1:Job               create
~   vpc-native-check-analytics-report-cron                     kubernetes:batch/v1:CronJob           update
~   vpc-native-worker-job-deployment                           kubernetes:apps/v1:Deployment         update
~   vpc-native-user-posts-analytics-refresh-cron               kubernetes:batch/v1:CronJob           update
~   vpc-native-sync-subscription-with-cio-cron                 kubernetes:batch/v1:CronJob           update
~   vpc-native-generate-search-invites-cron                    kubernetes:batch/v1:CronJob           update
~   vpc-native-clean-stale-user-transactions-cron              kubernetes:batch/v1:CronJob           update
... and 11 other changes