[P1] Enforce upstream timeouts and response limits while reading #51

Recorded during review of main at a1eb305ccfa2f3fc8ddede4875765cf1b099bd2b. This issue records a finding only; no implementation changes were made or requested.

Finding

The shared client has no request timeout. The 10 MB proxy response limit is checked only after upstream.bytes() buffers the entire body. Slow or oversized responses can hold resources indefinitely or exhaust memory before the limit takes effect. The locally inspected reqwest defaults have no request/read timeout.

Evidence

• src/main.rs:47
• src/proxy.rs:358

Desired outcome

Apply bounded request/read deadlines and enforce the response limit incrementally while reading. Cover stalled and oversized upstream responses with local fixtures.