fix(vmafx-mcp): harden HTTP server against Slowloris + bound shutdown

[lusoris]

Summary

• cmd/vmafx-mcp/main.go (~L63) constructed its &http.Server{...}
  literal with only Addr + Handler, leaving ReadHeaderTimeout,
  ReadTimeout, WriteTimeout, and IdleTimeout at their default
  0 (no limit). That is a textbook CWE-400 Slowloris vector:
  a misbehaving client can dribble header bytes indefinitely, hold
  connections open, and exhaust the server's goroutine and FD budget.
• The graceful-shutdown path also called srv.Shutdown(context.Background())
  with no deadline, so a stalled in-flight request could hang the
  shutdown forever and prevent the process from exiting.
• Fix mirrors the hardened pattern already established by
  cmd/vmafx-server/http_server.go (runHTTP, ~L171–190): four
  timeouts on the http.Server literal + context.WithTimeout(..., observability.GracefulShutdownTimeout) (30s) wrapping the
  Shutdown call.

Diff (essence)

httpSrv := &http.Server{
    Addr:              addr,
    Handler:           handler,
    ReadHeaderTimeout: 10 * time.Second,   // Slowloris guard
    ReadTimeout:       30 * time.Second,
    WriteTimeout:      120 * time.Second,
    IdleTimeout:       60 * time.Second,
}
// ...
go func() {
    <-ctx.Done()
    shutdownCtx, cancel := context.WithTimeout(
        context.Background(), observability.GracefulShutdownTimeout)
    defer cancel()
    _ = httpSrv.Shutdown(shutdownCtx)
}()

ADR-0108 deliverables checklist

• Research digest — no digest needed: trivial security
  hardening against a textbook CWE-400 (Slowloris) vector; the
  authoritative pattern is already in tree at
  cmd/vmafx-server/http_server.go.
• Decision matrix — no alternatives: only-one-way fix; the
  four Go net/http timeouts + bounded shutdown are the standard
  hardening, and the concrete values are reused verbatim from the
  vmafx-server hardening (already justified there).
• AGENTS.md invariant note — no rebase-sensitive invariants:
  cmd/vmafx-mcp/main.go is a fork-added Go file (ADR-0703 family);
  it has no upstream Netflix/vmaf counterpart, so no rebase conflict
  is possible.
• Reproducer / smoke test — cd <repo> && go vet ./cmd/vmafx-mcp/... && go build ./cmd/vmafx-mcp/ both succeed. Manual Slowloris probe
  before/after: slowhttptest -c 200 -H -u http://127.0.0.1:3000 —
  pre-fix the server holds the connections open until OS-level FD
  exhaustion; post-fix every slow header drip is dropped after the
  10s ReadHeaderTimeout.
• Changelog fragment —
  changelog.d/fixed/vmafx-mcp-http-server-hardening.md (per ADR-0221;
  rolled into CHANGELOG.md by scripts/release/concat-changelog-fragments.sh).
• Rebase notes — no rebase impact: cmd/vmafx-mcp/main.go is
  fork-added (Go), has no upstream counterpart in Netflix/vmaf, and
  cannot conflict on /sync-upstream runs.

Test plan

• go vet ./cmd/vmafx-mcp/... — clean.
• go build ./cmd/vmafx-mcp/ — succeeds.
• pre-commit run --files cmd/vmafx-mcp/main.go changelog.d/fixed/vmafx-mcp-http-server-hardening.md — all hooks
  pass.
• CI (Go-CI / security-scans) gates green before merge.
• (optional, manual) slowhttptest Slowloris probe against the
  running binary — refused after 10s instead of indefinitely held.

Out of scope

• Per-request Handler timeouts inside the MCP streamable transport
  (those are owned by the SDK).
• TLS termination — vmafx-mcp continues to delegate that to the
  ingress / sidecar.
• vmafx-server / vmafx-controller — already hardened (this PR only
  back-fills the pattern to vmafx-mcp).

Refs: ADR-0703 (vmafx-server Go service scaffolding pattern reused
here), ADR-0108 (deliverables checklist).