Improvements to Stirling Engine to prepare for SaaS release (#6603)

# Description of Changes
- Use pool for postgres connections
- Add ability to require user ID to be set on API calls to the engine
- Add process-wide concurrency cap on AI access (in addition to existing
user caps)
- Allow number of workers (threads) to be specified for stirling engine
- Update env var names to reflect that the DB is not just for RAG

engine/.env

@@ -14,19 +14,30 @@ STIRLING_FAST_MODEL=anthropic:claude-haiku-4-5
 STIRLING_SMART_MODEL_MAX_TOKENS=8192
 STIRLING_FAST_MODEL_MAX_TOKENS=2048
 
-# RAG Configuration — retrieval-augmented generation is always on.
-# Embedding provider credentials are handled natively (e.g. VOYAGE_API_KEY for VoyageAI).
-STIRLING_RAG_EMBEDDING_MODEL=voyageai:voyage-4
+# Process-wide cap on concurrent model API calls, shared by both model tiers.
+# Per-request fan-outs (chunked reasoner workers, contradiction detection) are
+# bounded per request; this bounds their product across concurrent requests.
+STIRLING_MODEL_MAX_CONCURRENCY=32
 
-# Vector store backend: "sqlite" (embedded) or "pgvector" (external Postgres).
-STIRLING_RAG_BACKEND=sqlite
+# Document store: the one database holding vector chunks, ordered page text,
+# and ACL rows. Backend is "sqlite" (embedded sqlite-vec) or "pgvector"
+# (external Postgres).
+STIRLING_DOCUMENTS_BACKEND=sqlite
 
 # Path to the sqlite-vec database file (used when backend=sqlite).
-STIRLING_RAG_STORE_PATH=data/rag.db
+STIRLING_DOCUMENTS_SQLITE_PATH=data/rag.db
 
 # Postgres DSN for pgvector (used when backend=pgvector). Leave empty when backend=sqlite.
 # Example: postgresql://user:password@host:5432/dbname
-STIRLING_RAG_PGVECTOR_DSN=
+STIRLING_DOCUMENTS_PGVECTOR_DSN=
+
+# Connection pool bounds for the pgvector backend.
+STIRLING_DOCUMENTS_PGVECTOR_POOL_MIN_SIZE=1
+STIRLING_DOCUMENTS_PGVECTOR_POOL_MAX_SIZE=10
+
+# RAG Configuration - retrieval-augmented generation is always on.
+# Embedding provider credentials are handled natively (e.g. VOYAGE_API_KEY for VoyageAI).
+STIRLING_RAG_EMBEDDING_MODEL=voyageai:voyage-4
 
 STIRLING_RAG_CHUNK_SIZE=512
 STIRLING_RAG_CHUNK_OVERLAP=64
@@ -57,6 +68,11 @@ STIRLING_CHUNKED_REASONER_NOTES_CHAR_BUDGET=250000
 STIRLING_MAX_PAGES=200
 STIRLING_MAX_CHARACTERS=200000
 
+# Reject API requests that lack an X-User-Id header. Self-hosted deployments
+# with security disabled have no user identity, so this is off by default.
+# Multi-tenant (SaaS) deployments must set it to true.
+STIRLING_REQUIRE_USER_ID=false
+
 # PostHog analytics. Set STIRLING_POSTHOG_ENABLED=true and provide an API key to enable.
 STIRLING_POSTHOG_ENABLED=false
 STIRLING_POSTHOG_API_KEY=phc_VOdeYnlevc2T63m3myFGjeBlRcIusRgmhfx6XL5a1iz