Let workers drain and restart cleanly before leaked memory takes down the host

.env.example

@@ -15,3 +15,20 @@ AMI_ANTENNA_API_BASE_URL=http://localhost:8000/api/v2
 AMI_ANTENNA_API_AUTH_TOKEN=your_antenna_auth_token_here
 AMI_ANTENNA_API_BATCH_SIZE=4
 AMI_ANTENNA_SERVICE_NAME="AMI Data Companion"
+
+# Worker process recycling. The worker exits cleanly at the next batch
+# boundary when it receives SIGUSR1 (e.g. `supervisorctl signal USR1 <program>`),
+# after processing AMI_WORKER_MAX_JOBS jobs, or when its resident memory,
+# sampled between jobs, reaches or exceeds AMI_WORKER_MAX_RSS_MB (in MiB).
+# 0 disables either cap.
+#
+# Recycling requires a process manager configured to restart the worker after
+# a *successful* exit, because a drain exits with status 0. The usual defaults
+# do not: supervisord's `autorestart=unexpected` and systemd's
+# `Restart=on-failure` both treat status 0 as a reason to stay stopped, as
+# does Docker's `on-failure` restart policy. Set `autorestart=true`
+# (supervisord), `Restart=always` (systemd), or `--restart always` /
+# `unless-stopped` (Docker). Without it the worker recycles once and stays
+# down.
+# AMI_WORKER_MAX_JOBS=10
+# AMI_WORKER_MAX_RSS_MB=8192