Merge branch 'optimize/ai-gateway-20260619'

AI Gateway critical fixes:

- fix: add LLM HTTP timeout (120s) — was unbounded
- fix: share global HTTP transport with connection pooling
- fix: add retry backoff to AutoCorrectGenerate loop

Author: mahmut-Abi

internal/admin/chatbot/client.go

@@ -13,6 +13,7 @@ import (
 	"net/http"
 	"os"
 	"strings"
+	"time"
 )
 
 // Message represents a single turn in a conversation.
@@ -39,7 +40,16 @@ type openAIAdapter struct {
 	client   *http.Client
 }
 
-const openAIChatCompletionsPath = "/v1/chat/completions"
+const (
+	openAIChatCompletionsPath = "/v1/chat/completions"
+	defaultLLMTimeout         = 120 * time.Second
+	defaultLLMIdleTimeout     = 90 * time.Second
+)
+
+var defaultLLMTransport = &http.Transport{
+	MaxIdleConns:    10,
+	IdleConnTimeout: defaultLLMIdleTimeout,
+}
 
 // openAIStreamResponse represents a single SSE chunk returned by the server.
 type openAIStreamResponse struct {
@@ -64,18 +74,24 @@ func NewOpenAIAdapter(endpoint, apiKey, model string, temperature float64) LLMCl
 		slog.Warn("CHATBOT_INSECURE_TLS is enabled — TLS certificate verification is disabled for LLM API calls")
 	}
 
-	transport := &http.Transport{
-		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: insecureSkipVerify,
-		},
+	transport := defaultLLMTransport
+	if insecureSkipVerify {
+		transport = &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: true,
+			},
+		}
 	}
 
 	return &openAIAdapter{
 		endpoint: endpoint,
 		apiKey:   apiKey,
 		model:    model,
 		temp:     temperature,
-		client:   &http.Client{Transport: transport},
+		client: &http.Client{
+			Transport: transport,
+			Timeout:   defaultLLMTimeout,
+		},
 	}
 }
 

internal/admin/chatbot/validator.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"log/slog"
 	"strings"
+	"time"
 
 corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
@@ -173,6 +174,8 @@ func AutoCorrectGenerate(
 	}
 
 	for attempt := 1; attempt <= maxRetries; attempt++ {
+		time.Sleep(time.Duration(attempt) * time.Second)
+
 		feedback := fmt.Sprintf(correctionPrompt, err.Error())
 
 		correctedResponse, retryErr := collectFullStreamingResponse(ctx, llm, feedback, history)