Give the login rate limit tests the default request timeout (closes #61)

newTestServer left downstream_timeout at zero, so every request in those
tests ran with an already expired per-request timeout. It now uses
config.DefaultDownstreamTimeout, as a real config would. Approved by the
owner on the issue.

Model: opus-5-5

internal/server/login_rate_limit_internal_test.go

@@ -56,6 +56,7 @@ func newTestServer(t *testing.T) *Server {
 		StateDir:          stateDir,
 		DBURL:             "file:" + filepath.Join(stateDir, "state.sqlite3"),
 		TrustedProxies:    []netip.Prefix{netip.MustParsePrefix("10.0.0.0/8")},
+		DownstreamTimeout: config.DefaultDownstreamTimeout,
 	}
 
 	lc := fxtest.NewLifecycle(t)