fix(flowise): survive a stalled prebuilt-binary download

GitLab#1 of run 33414875521 died in the flowise image build. The obvious line is
not the cause:

    npm error command sh -c prebuild-install -r napi || node-gyp rebuild
    npm error prebuild-install warn install Request timed out
    ...
    npm error gyp ERR! stack Error: not found: make

`not found: make` is the third domino. Counting the whole job settles it:
`Request timed out` 38, sqlite3 failures 6, `not found: make` 6 -- and sharp
failures 16, of 22 build attempts total. sharp emits no gyp output at all; its
fallback dies at `can-compile` because the image ships no libvips. A toolchain
would have touched 6 of 22 and left the dominant mode alone.

What actually aborts: node >=19 puts a 5s socket-inactivity timeout on
https.globalAgent (v24.19.0 lib/internal/http.js:263-268), while sharp and
prebuild-install fetch their prebuilt binaries through simple-get, which sets no
timeout of its own and never retries. Any 5s gap in the byte stream of the ~8 MB
libvips tarball drops the whole RUN layer.

The trigger was environmental, and it is worth being explicit that it was: the
same run, the same commit and the same base-image digest built flowise green
twice in another job, overlapping these failures. MTU is 1500 in both jobs, there
is no proxy configured, and svc-net-tor redirects only 10.240.0.0/12, so
github.com never enters Tor. The apt layer of the failing build itself fetched at
6178 kB/s and npm resolved all 3196 packages in the same 157s as the green one.

The fragility is ours. Eleven lines above, the apt layer already carries
-o Acquire::Retries=3; the npm layer had nothing. That asymmetry is what this
closes.

NODE_OPTIONS is attached to the install command alone rather than exported for
the layer: npm init and npm pkg set reach no network, and npm install is what
spawns the lifecycle scripts that download. --require is kAllowedInEnvvar on this
node (src/node_options.cc:1124-1127). No ENV, so the runtime image and flowise's
own HTTP behaviour are untouched. 60s is 12x headroom over a real stall while a
genuinely dead socket still fails inside a minute.

Not proven: that 60s clears this particular stall. The stall duration is nowhere
in the log, and per 850b795a51 a local quality gate cannot answer a
network-dependent question at all. Only a CI build closes that.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-flowise/files/Dockerfile

@@ -4,6 +4,7 @@ FROM ${FLOWISE_BASE_IMAGE}:${FLOWISE_BASE_TAG}
 
 ARG FLOWISE_VERSION
 ARG FLOWISE_SQLITE_VERSION
+ARG FLOWISE_SOCKET_TIMEOUT_SHIM=/tmp/socket-timeout.cjs
 
 RUN rm -rf /var/lib/apt/lists/* \
     && apt-get -o Acquire::Retries=3 update \
@@ -17,9 +18,11 @@ ENV FLOWISE_HOME=/opt/flowise
 
 WORKDIR ${FLOWISE_HOME}
 
-RUN npm init -y > /dev/null \
+RUN echo 'require("http").globalAgent.options.timeout=60000;require("https").globalAgent.options.timeout=60000' > "${FLOWISE_SOCKET_TIMEOUT_SHIM}" \
+    && npm init -y > /dev/null \
     && npm pkg set "overrides.better-sqlite3=^${FLOWISE_SQLITE_VERSION}" \
-    && npm install --omit=dev "flowise@${FLOWISE_VERSION}" \
+    && NODE_OPTIONS=--require="${FLOWISE_SOCKET_TIMEOUT_SHIM}" npm install --omit=dev "flowise@${FLOWISE_VERSION}" \
+    && rm -f "${FLOWISE_SOCKET_TIMEOUT_SHIM}" \
     && ln -s "${FLOWISE_HOME}/node_modules/.bin/flowise" /usr/local/bin/flowise \
     && chown -R node:node "${FLOWISE_HOME}"