flux-network: harden HTTP failures and remove hot-path allocations

[Bronek]

This PR builds on #142. It adds lingering close for rejected requests, outbound request deadlines with explicit failure reasons, support for the full HTTP status range, and allocation-free processing on warm connections.

Lingering close

A response that ends an incomplete request stream shuts only the write side once the answer drains, then reads and discards the peer's remaining upload. This lets the peer receive the HTTP error and EOF instead of a connection reset.

HttpConfig::linger: Option<Linger> bounds this phase by idle time since the last inbound byte (5 seconds by default) and total elapsed time (30 seconds by default). The clocks start only after the transport has taken the complete answer; until then, the ordinary idle timeout still bounds a peer that stops reading. without_linger() restores immediate close after the response drains.

If a connection exceeds its buffer limit while a request is pending, the service preserves the application's response, adds Connection: close, and then lingers. If no request is pending, it responds with 431 and lingers. A complete request answered with Connection: close continues to drain and close normally; lingering is reserved for lost request framing.

Request deadlines and failure reasons

HttpConfig::request_timeout: Option<Duration> gives each outbound request a deadline starting when its bytes are queued. It defaults to None.

An outbound request that can no longer be answered produces HttpEvent::RequestFailed { token, reason } before the corresponding Disconnected event:

pub enum RequestFailure {
    Timeout,
    Malformed,
    TooLarge,
    Disconnected,
}

TooLarge distinguishes operator-configured limits from malformed responses, while Disconnected distinguishes a lost in-flight request from an idle endpoint closing.

Status framing

Responses may use any status from 100 through 599. Common statuses use their conventional reason phrases; other statuses use an empty phrase, as RFC 9112 permits. A caller-chosen 1xx is final: it completes the request without a content length or body.

Invalid responses—such as an out-of-range status, invalid header, or response without a pending request—are refused before the body closure runs.

Allocation discipline

After connection warm-up, HTTP request serving and outbound response parsing allocate nothing. Parsing uses a fixed stack header scratch, an in-flight request records only whether it was HEAD, and respond_with renders into a service-owned reusable buffer.

The allocation test warms both directions, runs 1,000 round trips each way under a thread-local counting allocator, and requires zero allocation events.

HttpConfig::max_headers must be in 1..=MAX_HEADERS (128). HttpService::new validates direct struct construction under the same rule as with_max_headers, so both configuration paths behave identically.

Verification

The new test suites cover lingering over TCP and Unix-domain sockets, cap timing, over-limit pending responses, all request-failure reasons and their event ordering, status boundaries, and allocation-free warm paths. Additional HTTP and in-module tests pin header-count boundaries, rejected response composition, incomplete response heads, and internal discard behaviour without exposing representation through the public API.

Workspace tests, Clippy with warnings denied, the nightly formatting check, and cargo doc pass without new warnings.

The existing loopback tests still select unused TCP ports before binding them, so they retain a known race. A following change makes listen return its bound endpoint and converts the tests to bind port zero; until then, a job that loses this race can be rerun.

Scope

This PR does not change listen, which still returns io::Result<()>. Reporting the bound endpoint, binding tests directly to ephemeral ports, and avoiding the scratch copy in the slice-based respond path remain separate follow-up changes.

Base: #142.

Refer: #143

Assisted-by: Claude Code:claude-fable-5
Assisted-by: Codex:gpt-5