audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/httpserver.go

@@ -134,6 +134,26 @@ func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 	}, cfg.setupTokenPath)
 }
 
+// newHTTPServer bounds what a client may hold the panel's server for (audit
+// 2026-10-12, L14): the request with its body - a form, or a domain export
+// of 1 MiB at most - in 30 s; the answer in 60 s, the slowest page being one
+// that asks DNS; an idle kept-alive connection 2 min. The full backup moves
+// its own write deadline to two hours: it streams for as long as the archive
+// takes (handlers.HandleBackup). net/http, Go 1.26: ReadTimeout covers the
+// header and the body, WriteTimeout runs from the end of the header's read
+// to the end of the response's write, IdleTimeout is the wait for the next
+// request on a kept-alive connection.
+func newHTTPServer(addr string, h http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           h,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		WriteTimeout:      60 * time.Second,
+		IdleTimeout:       2 * time.Minute,
+	}
+}
+
 // serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
 // the database handle shared by all roles: setup, login and the authenticated
 // panel surface (security.md).
@@ -146,11 +166,7 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 		return err
 	}
 
-	srv := &http.Server{
-		Addr:              cfg.httpAddr,
-		Handler:           srvApp.Handler(),
-		ReadHeaderTimeout: 10 * time.Second,
-	}
+	srv := newHTTPServer(cfg.httpAddr, srvApp.Handler())
 
 	// Shut the server down cleanly when the process is asked to stop.
 	go func() {