Fix data race between stream Drain and concurrent Read

[somaz94]

stream.Read takes rLock before reading c.r, but Drain ran
io.Copy(io.Discard, c.r) in a goroutine without the lock, racing with an
in-flight read on the same reader (#156).

This takes rLock in the drain goroutine so the two paths are serialized, and
makes the result channel buffered so the goroutine does not strand if Drain
returns on the timeout path.

Validation (local):

• Added server/stream_test.go reproducing the race. go test -race ./server/
  reports the race on the current code and passes with the fix (verified by
  reverting stream.go).
• go vet ./..., go build ./..., go test -short ./... all pass.

Note: CI runs go test -short (no -race), so this regression only shows under
-race. Running go test -race ./server/ catches it.

Closes #156

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[somaz94]

I have read the CLA Document and I hereby sign the CLA

[slinkydeveloper]

This is great, thank you!