Answer 504, not 408, when a request outlasts its time limit (closes #70)

The hand-written time limit middleware answered 408 and wrote that
answer from its own goroutine while the handler could still be writing.
It is replaced by chi's middleware.Timeout, placed after
JSONResponseMiddleware so its 504 is not lost behind a 200.

After a database read or other lookup, a handler asks deadlinePassed
whether the request's time limit passed and, if so, answers 504 instead
of its 500, 404 or partial result: the AS and prefix reads, cut off
while reading rows, return part of them, or none, without an error.
JSONValidationMiddleware answers 504 with the JSON error body when the
limit has passed and the handler wrote nothing. status.json and
/api/v1/stats answer 504 when their 4-second database read runs out.

Model: opus-5-5

internal/server/routes.go

@@ -16,9 +16,12 @@ func (s *Server) setupRoutes() {
 	r.Use(middleware.RealIP)
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
-	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
-	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
 	r.Use(JSONResponseMiddleware)
+	// Timeout must come after JSONResponseMiddleware, which sends its answer
+	// when the handler returns and would send a 200 ahead of Timeout's 504 for
+	// a handler that wrote nothing.
+	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
+	r.Use(middleware.Timeout(requestTimeout))
 
 	// Routes
 	r.Get("/", s.handleIndex())