feat: add configurable pipeline retry and concurrency settings (#157)

- Add `pipeline` config section with `retry_preset` and `max_concurrent_pipelines` options
- Add `subscription` retry preset with extended 6h max interval for Anthropic rate limit windows
- Replace Promise.allSettled with concurrency-limited runner for vuln/exploit pipelines
- Wire pipeline config through client, shared types, and workflow activity proxy selection

configs/config-schema.json

@@ -78,6 +78,23 @@
       "required": ["login_type", "login_url", "credentials", "success_condition"],
       "additionalProperties": false
     },
+    "pipeline": {
+      "type": "object",
+      "description": "Pipeline execution settings for retry behavior and concurrency",
+      "properties": {
+        "retry_preset": {
+          "type": "string",
+          "enum": ["default", "subscription"],
+          "description": "Retry preset. 'subscription' extends timeouts for Anthropic subscription rate limit windows (5h+)."
+        },
+        "max_concurrent_pipelines": {
+          "type": "string",
+          "pattern": "^[1-5]$",
+          "description": "Max concurrent vulnerability pipelines (1-5, default: 5)"
+        }
+      },
+      "additionalProperties": false
+    },
     "rules": {
       "type": "object",
       "description": "Testing rules that define what to focus on or avoid during penetration testing",

configs/example-config.yaml

@@ -39,7 +39,12 @@ rules:
     - description: "Prioritize beta admin panel subdomain"
       type: subdomain
       url_path: "beta-admin"
-    
+
     - description: "Focus on user profile updates"
       type: path
-      url_path: "/api/v2/user-profile"
+      url_path: "/api/v2/user-profile"
+
+# Pipeline execution settings (optional)
+# pipeline:
+#   retry_preset: subscription          # 'default' or 'subscription' (6h max retry for rate limit recovery)
+#   max_concurrent_pipelines: 2         # 1-5, default: 5 (reduce to lower API usage spikes)