Add request timeout middleware

[AbelOsaretin]

What

No timeout is set on HTTP requests. Slow clients can hold connections indefinitely and exhaust server resources.

Why

Without request timeouts, a slow or malicious client can tie up Express workers indefinitely, causing denial of service.

Scope

• Add a timeout middleware for all routes
• Configurable timeout via env var
• Return 408 Request Timeout on expiration
• Apply stricter timeout for admin endpoints

Acceptance Criteria

• Request timeout middleware applied to all routes
• REQUEST_TIMEOUT_MS env var (default: 30000)
• Requests exceeding timeout return 408
• Admin endpoints have shorter timeout (configurable)

Technical Context

• src/index.ts — Express app setup
• New env var: REQUEST_TIMEOUT_MS (default: 30000)
• New env var: ADMIN_REQUEST_TIMEOUT_MS (default: 60000)