fix: API quality fixes from code review (HAN-398)

- Blocker 1: move publishLocked inside job.mu to eliminate SSE duplicate-event
  race between replay and live subscription
- Blocker 2: add http.MaxBytesReader (1 MB) to startTraversal to prevent
  memory exhaustion from large request bodies
- Should Fix 1: thread context.Context into newHandler() and cancel it on
  Server.Shutdown() to stop the ticker goroutine cleanly
- Should Fix 2: add unsubscribe() method and defer it in streamTraversal
  so disconnected SSE clients don't accumulate stale channels
- Suggestion: add ReadHeaderTimeout: 10s to http.Server to mitigate Slowloris

All tests pass: go test -race ./... and go vet ./... both clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

web/api/server.go

@@ -26,8 +26,9 @@ var staticFiles embed.FS
 
 // Server is the HTTP API server.
 type Server struct {
-	addr string
-	srv  *http.Server
+	addr   string
+	srv    *http.Server
+	cancel context.CancelFunc
 }
 
 // NewServer creates a new Server that listens on addr (e.g. ":8080").
@@ -39,7 +40,9 @@ func NewServer(addr string) *Server {
 // server has accepted its first connection or the address is bound.
 // Call Shutdown to stop gracefully.
 func (s *Server) Start() error {
-	h := newHandler()
+	ctx, cancel := context.WithCancel(context.Background())
+	s.cancel = cancel
+	h := newHandler(ctx)
 
 	sub, err := fs.Sub(staticFiles, "static")
 	if err != nil {
@@ -48,11 +51,12 @@ func (s *Server) Start() error {
 	h.registerStatic(sub)
 
 	s.srv = &http.Server{
-		Addr:         s.addr,
-		Handler:      corsMiddleware(h.mux),
-		ReadTimeout:  30 * time.Second,
-		WriteTimeout: 0, // SSE streams need no write timeout
-		IdleTimeout:  120 * time.Second,
+		Addr:              s.addr,
+		Handler:           corsMiddleware(h.mux),
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      0, // SSE streams need no write timeout
+		IdleTimeout:       120 * time.Second,
 	}
 
 	ln, err := net.Listen("tcp", s.addr)
@@ -78,6 +82,9 @@ func (s *Server) Addr() string {
 // Shutdown gracefully stops the server, waiting up to timeout for in-flight
 // requests to complete.
 func (s *Server) Shutdown(timeout time.Duration) error {
+	if s.cancel != nil {
+		s.cancel()
+	}
 	if s.srv == nil {
 		return nil
 	}