Import the original book when its conversion fails (#1094)

CHANGELOG.md

@@ -23,6 +23,12 @@ is for things you can see or feel when running the app.
 
 - **Your library keeps working when its extra fields can't be read.** Book pages, the books table and both search screens all ask the library for its custom-column definitions — the extra fields you can add to a book in Calibre. If that lookup failed because the library was mid-write, its folder had moved, or the definitions table wasn't there yet, those pages returned an error instead of simply leaving the extra fields out, even though the rest of the library was perfectly readable. Custom columns are supplementary, so these pages now load without them and note the reason in the log ([#1153](https://github.com/new-usemame/Calibre-Web-NextGen/issues/1153)).
 
+- **A book that fails to convert now still lands in your library.** If CWA could not convert an incoming book to your target format — a big or image-heavy PDF that ran out of time, a file with internals Calibre chokes on, a format needing a plugin you don't have — the book was dropped altogether: no entry in the library, and the file gone from the ingest folder. The log even said `Successfully processed` on its way past, so nothing suggested a book had gone missing until you noticed it wasn't there. A failed conversion says nothing about whether the file is a readable book, and the two settings that decline to convert — auto-convert switched off, or the format on your do-not-convert list — already import the original, so this was inconsistent as well as lossy. The original is now imported whenever a conversion fails.
+
+  A long conversion needed a second fix to get there. Nothing inside the app limited how long a conversion could run; the only limit was the watchdog wrapped around the whole ingest step, and when that fired it killed the ingest outright, so none of the recovery above could happen — which is exactly what the reported 63MB PDF hit after 45 minutes. Conversions now have their own time limit set just inside the watchdog's, so running long ends as a normal failure and the book is imported in its original format instead of disappearing. Raising **Ingest Timeout** in CWA Settings raises both.
+
+  Two smaller things from the same report. The log now names the folder it keeps the copy in, `/config/processed_books/failed/`, where before it said only "failed backup" — a copy existed, but not where. And when a conversion overran, the service claimed the app "should have timed out internally", which was misleading advice about a limit that did not exist; it now points at the setting that does control it. Reported by [@auspex](https://github.com/auspex) ([#1094](https://github.com/new-usemame/Calibre-Web-NextGen/issues/1094)).
+
 - **Opening your library no longer runs the same search twice.** Every visit to the library asked the server for the first page of books, then immediately asked for it again at a different size and threw the first answer away. Nothing looked wrong — the wasted answer never reached the screen — but on a large library that first page is the slowest query on it, and it was being run twice on every load, for every reader. The grid now waits until it knows how many columns it has before asking, so the page is fetched once ([#1144](https://github.com/new-usemame/Calibre-Web-NextGen/issues/1144)).
 
 ## [v4.1.21] - 2026-07-25