fix(api): reject oversized JSON and idle HTTP connections #1137

The HTTP server caps header time only. Request bodies can trickle forever, and readJSON truncates at 1 MiB instead of failing.

Found on master 6eadec3f.

What happens

go/cmd/ftw/main.go and bootstrap.go set ReadHeaderTimeout: 10s and nothing else: no ReadTimeout, WriteTimeout, or IdleTimeout.

readJSON uses io.LimitReader(r.Body, 1<<20). Oversized JSON is truncated, then json.Unmarshal either 400s opaquely or succeeds on a complete prefix. The leftover body stays on the connection. ftw-updater already uses http.MaxBytesReader.

What a fix needs

• ReadTimeout / WriteTimeout / IdleTimeout on both the boot server and the main server.
• readJSON through http.MaxBytesReader; fail when the cap is hit, do not unmarshal a prefix.
• Tests for a body just under 1 MiB, just over, and the MaxBytesReader error path.

This is independent of DuckDB (#1129) and of the history points cap.