Add HTTP server timeouts to mitigate slowloris/slow-read DoS

[xmtp-coder-agent]

Resolves #1888

Summary

• Adds ReadHeaderTimeout (10s), ReadTimeout (30s), and WriteTimeout (5m) to the API http.Server to mitigate slowloris and slow-read denial-of-service attacks
• Removes the TODO comment about needing more timeouts

Timeout Rationale

Timeout	Value	Why
ReadHeaderTimeout	10s	Prevents slowloris attacks that trickle request headers — 10s is generous for any legitimate client
ReadTimeout	30s	Bounds total time to read the full request (headers + body) — covers large publish payloads
WriteTimeout	5m	Matches IdleTimeout — must be long enough for server-streaming RPCs like SubscribeEnvelopes

Test Plan

• go build ./pkg/api/... compiles cleanly
• go vet ./pkg/api/... passes
• CI tests pass (existing tests are unaffected — only timeout config changed)

🤖 Generated with Claude Code

Note

Add HTTP server timeouts to mitigate slowloris/slow-read DoS attacks

Sets ReadHeaderTimeout (10s), ReadTimeout (30s), and WriteTimeout (5m) on the http.Server in api.NewAPIServer. These timeouts protect against slowloris and slow-read denial-of-service attacks by bounding how long the server waits on a client. Behavioral Change: all API requests are now subject to these timeouts, where previously none were enforced.

^{Macroscope summarized a54a5fc.}