Isolate CLI workers and module serialization

etc/uce/settings.cfg

@@ -14,6 +14,12 @@ FCGI_PORT=9993
 CLI_SOCKET_PATH=/run/uce/cli.sock
 # Keep the CLI/admin socket private by default; set 0660 only for a trusted group.
 CLI_SOCKET_MODE=0600
+# Keep CLI/test module caches out of public FastCGI workers. Set to 0 only for
+# the legacy shared pool; dedicated workers are additional to WORKER_COUNT.
+CLI_WORKER_COUNT=2
+# Recycle dedicated CLI workers before broad test/admin runs retain every unit.
+# Zero disables recycling; public FastCGI workers are never request-count recycled.
+CLI_WORKER_MAX_REQUESTS=8
 
 # Built-in HTTP/WebSocket listener used for WebSocket Upgrade requests.
 # Keep this behind nginx/Apache on localhost or firewall it from public access.
@@ -59,6 +65,8 @@ WASM_MEMORY_LIMIT_BYTES=536870912
 WASM_EPOCH_DEADLINE_TICKS=200
 WASM_EPOCH_PERIOD_MS=50
 WASM_INVOCATION_TIMEOUT_MS=30000
+# Bound each short-lived proactive/precompile serialized-module child.
+WASM_SERIALIZE_TIMEOUT_SECONDS=120
 MYSQL_PERSISTENT_POOL_SIZE=8
 MYSQL_PERSISTENT_POOL_IDLE_TIMEOUT_SECONDS=300