Proposal: make durable MCP submission compensation wait configurable

[AoHanBei]

Problem

PR #4933 protects cancellation compensation for durable MCP submissions.

When the caller is cancelled during local persistence, DeerFlow starts remote
compensation and currently waits for a fixed five-second deadline before
propagating the original cancellation. If the deadline expires, compensation
continues as a tracked background task.

The five-second value is currently hard-coded in app/mcp_tasks/service.py.

Different deployments may have different requirements:

• high-latency remote MCP services may benefit from a longer synchronous wait;
• shutdown-sensitive deployments may prefer a shorter wait;
• the current five-second behavior should remain the default.

Proposed scope

Add one restart-required setting under mcp_tasks, for example:

mcp_tasks:
  untracked_compensation_wait_seconds: 5

The setting would:

• default to 5 seconds, preserving current behavior;
• control only how long the caller waits for compensation;
• never cancel or abandon the compensation task when the deadline expires;
• preserve the original CancelledError;
• leave ordinary persisted cancellation retries unchanged.

Non-goals

• changing MCP tool_call_timeout;
• changing the remote cancellation protocol;
• adding dynamic config reload;
• changing persisted cancellation retry behavior;
• adding a database or API migration.

Validation

I would add deterministic coverage for:

• the default five-second configuration;
• invalid negative values;
• startup configuration wiring;
• a custom zero/short wait returning while compensation continues;
• repeated caller cancellation not extending the configured deadline.
  Would this narrowly scoped configuration capability be useful, or would you
  prefer to keep the five-second policy internal?