server: assert timeouts on the served http.Server, not just the constructor (closes #120)

The timeout tests called newHTTPServer directly, leaving Run's call
site unguarded: a Run that built its http.Server inline would drop
every timeout with the suite still green. TestRunWiresSocketTimeouts
now wires a Server as cmd/dnswatcher does (minus watcher and resolver,
so no live DNS), drives Run with an unbindable port so it stores its
http.Server and returns without listening, and asserts the served
server carries all four timeouts and both required relationships.
Reverting Run to an inline http.Server without timeouts fails it. The
near-tautological addr/handler test is dropped; the wiring test covers
the handler end to end.

The read-deadline note is corrected: a too-small ReadTimeout does not
make ReadHeaderTimeout unreachable (net/http applies it directly); it
installs an already-expired whole-request deadline. Verified against
the pinned go1.25 net/http.

Model: opus-4-8 (implementation); opus-5-5 (rebase)

TODO.md

@@ -23,9 +23,10 @@ Rationale, Design, TODO, License, Author) if any are still missing.
 
 # Completed Steps
 
-- 2026-09-28: the server timeout test now drives `Run` and checks the
-  `http.Server` it serves carries the timeouts; corrected the `ReadTimeout`
-  note in that test (closes #120).
+- 2026-09-21: server timeout test now drives `Run` and asserts the
+  served `http.Server` carries the timeouts; corrected the inverted
+  `ReadTimeout` rationale note (#120).
+
 - 2026-09-28: upaas deploy readiness — runtime image runs as unprivileged
   `dnswatcher`, Docker `HEALTHCHECK`, startup fails when the data directory is
   not writable, README "Running under upaas" (closes #147).
@@ -33,6 +34,7 @@ Rationale, Design, TODO, License, Author) if any are still missing.
   `internal/healthcheck`, and `internal/logger` (closes #110).
 - 2026-09-21: `go mod tidy` dropped the redundant `golang.org/x/sync`
   `// indirect` line so `script/bootstrap` leaves a clean tree (#132)
+
 - 2026-08-10: comment-only corrections to `script/bootstrap`,
   `script/cibuild`, and `Dockerfile.lint`. The `goimports` pin in
   `script/bootstrap` was justified by a claim that `script/fmt-check`

internal/server/server_test.go

@@ -55,7 +55,10 @@ func buildServer(t *testing.T) *server.Server {
 // TestRunWiresSocketTimeouts pins that the http.Server the running
 // server actually serves — the one Run builds and hands to
 // ListenAndServe — carries every socket-level timeout, plus the two
-// relationships the values must satisfy.
+// relationships the values must satisfy. Earlier tests asserted these
+// on newHTTPServer directly, which left the call site unguarded: a Run
+// that built its http.Server inline would drop every timeout with the
+// suite still green (https://git.eeqj.de/sneak/dnswatcher/issues/120).
 //
 // Run is driven to completion with an unbindable port: it builds and
 // stores s.httpServer, then ListenAndServe fails at once and Run
@@ -63,13 +66,16 @@ func buildServer(t *testing.T) *server.Server {
 // goroutine after Run returns, so reading s.httpServer is free of any
 // data race. Nothing here measures elapsed time.
 //
-// ReadTimeout must be at least ReadHeaderTimeout. net/http reads the
-// headers under ReadHeaderTimeout, then sets the read deadline for the
-// rest of the request to ReadTimeout, counted from when it started
-// reading the request. If ReadTimeout were smaller, a request whose
-// headers arrived after ReadTimeout but within ReadHeaderTimeout would
-// get a read deadline that had already passed, so reading its body
-// would fail at once.
+// On the ReadTimeout >= ReadHeaderTimeout relationship: a smaller
+// ReadTimeout does NOT make the header phase unreachable. net/http's
+// (*Server).readHeaderTimeout applies ReadHeaderTimeout directly, so
+// the header read keeps its full budget. What breaks is the
+// whole-request deadline: once the headers are read, readRequest
+// installs a read deadline of t0+ReadTimeout, which is already in the
+// past when ReadTimeout is the smaller value, severing the request.
+// Verified against the pinned go1.25 net/http (Dockerfile golang
+// 1.25-alpine; go.mod go 1.25.5): src/net/http/server.go readRequest
+// and (*Server).readHeaderTimeout.
 func TestRunWiresSocketTimeouts(t *testing.T) {
 	// Sets an env var and touches viper global state, so like the
 	// config tests it cannot use t.Parallel.