net: bound the WebSocket handshake and reply sends on SocketServer

[Yaraslaut]

Summary

• Adds handshakeTimeout and sendTimeout to SocketServerConfig, closing the two real defects identified in net: SocketServer has no connection cap, handshake timeout or idle timeout #534's rescope: an unauthenticated peer that connects and sends one byte parks a clientLoop thread and a file descriptor forever (no SO_RCVTIMEO anywhere on the accepted socket), and nothing ever bounded a server-side reply write, leaving PR net: reject illegal WebSocket frames, and bound the handshake read #558's ClientConnection::sendText retire-on-partial-write-failure catch unreachable and untestable (no SO_SNDTIMEO on the accepted socket).
• handshakeTimeout (default 10s, 0 disables) is enforced as a single deadline across the whole handshake read via a poll-with-remaining-budget loop added to readHttpHeaderBlock, deliberately not SO_RCVTIMEO (which only bounds each individual recv, as SocketBackendConfig's own doc comment already documents as a known weakness on the client side).
• sendTimeout (default 30s, 0 disables) is SO_SNDTIMEO, applied once per accepted connection in acceptLoop via the existing TcpSocket::setSendTimeout (previously used only by SocketBackend, morph#506).
• Extends the existing SocketServerConfig/SocketServer reference table in docs/spec/core/backend.md with the two new fields and the design rationale (that table already existed — the rescope comment's premise that no morph::net/SocketServer spec exists turned out to be stale, so this extends it rather than adding a new file).

Out of scope (per the rescope comment on #534)

• idleTimeout — rejected: a desktop GUI client left open is idle by design, and with no ping/pong keepalive there's no way to distinguish "idle" from "dead" without disconnecting working clients.
• maxConnections — real, but deferred to a follow-up ticket; not blocking this change.
• The per-connection in-flight cap mentioned in the issue body — a separate finding per the rescope, not addressed here.

Regression tests

Both added under the [morph534] tag in tests/net/test_socket_server.cpp, confirmed to fail before the fix (one on a timeout-bound assertion, one on a bounded wait) and pass after:

• handshakeTimeout: connects, sends one byte, never completes the handshake; confirms the stalled connection's fd is closed once reclaimed, instead of parking forever.
• sendTimeout (the acceptance clause the rescope comment added to this ticket): shrinks the client's receive window and floods large replies without ever draining them — the connection's read direction stays fully live (no reset, no FIN) throughout. Confirms the connection is retired (its model reclaimed, clientLoop exits) instead of continuing to dispatch further frames whose replies would be silently dropped.

Verification

• Full suite: ctest — 1800/1800 passing (net label: 193/193).
• Doxygen (WARN_AS_ERROR = FAIL_ON_WARNINGS) builds clean.
• Both new tests independently confirmed to fail on the pre-fix code (verified by temporarily reverting the wiring) and pass on the fix.

Adjacent finding filed, not fixed here

Two independent review passes (reuse and altitude, from the /simplify gate) flagged that the new poll-with-remaining-budget loop in readHttpHeaderBlock is a third independent copy of a pattern already inline in TcpSocket::connect() and in a test helper (FakeWsServer::acceptWithin) — filed as #831 rather than fixed here, since extracting a shared primitive means changing TcpSocket::connect(), which this change never otherwise touches, and carries its own design decision (the helper's shape).

Fixes #534

🤖 Generated with Claude Code

https://claude.ai/code/session_018fEUahMFF32wQLiWjbsfkc

[codecov]

Codecov Report

❌ Patch coverage is 79.31034% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
include/morph/net/detail/ws_handshake.hpp	80.76%	3 Missing and 2 partials ⚠️
include/morph/net/socket_server.hpp	66.66%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!