docs(tasks): decompose review 001 remediation Units 1-5 into taskgraph tasks

21 review-001 tasks across server/adapters/client/gateway/websocket/infra,
chunked from the 7-unit remediation plan in
docs/reviews/001-initial-implementation-review.md.

- Scope split by mechanism, not one-per-finding: 15 tasks in generation 1
  (parallelizable), 6 sequenced after their file-sharing precursors
- Deliberately deferred until dependent fixes land: projection/doc
  fidelity partial (Unit 6 beyond dependency hygiene), coverage backfills
  (COV-01..07 via in-task acceptance for forward.rs), and per-finding
  minors (OAI-06/07, HY-02/04/06/10/11, CON-08)
- Cross-crate WS-12 (alkcall demux 4 GiB discard alloc) noted for filing
  in alkcall, not here

taskgraph: validate clean, no cycles, 6 generations

tasks/server/review-001-hyper-server-knobs.md

@@ -0,0 +1,67 @@
+---
+id: review-001-hyper-server-knobs
+name: Configure hyper timeouts + decoy/405/proxy-path fixes (SRV-04, SRV-07, SRV-08, SRV-09, SRV-10)
+status: pending
+depends_on: []
+scope: moderate
+risk: low
+impact: component
+level: implementation
+tags: [server, review-001, stealth]
+---
+
+## Description
+
+Review 001 server-core minors, grouped because they are small, disjoint,
+and all land in `src/server/`:
+
+- **SRV-04**: `HyperBuilder` (`src/server/adapter.rs:217-224`) sets no
+  timer — hyper 1.11 *silently ignores* `header_read_timeout` without one
+  (verified against hyper source), so the slow-loris surface is open and
+  every keep-alive knob is off. Set a timer (tokio) + `header_read_timeout`
+  + h1/h2 keep-alive knobs. No concurrency cap exists in this crate (the
+  accept loop is the consumer's) — document that boundary in the module
+  doc.
+- **SRV-05**: `with_decoy` consumes `extra_routes` via `.take()`
+  (`adapter.rs:104`); a second builder call silently rebuilds without the
+  custom routes. Clone (or error on double-build).
+- **SRV-07**: the decoy is only the router `fallback` — method-mismatch
+  requests return axum's bare 405 with no `Server: nginx` header, which
+  single-handedly distinguishes alkhttp from nginx in decoy deployments
+  (empirically verified). Wrap 405s with the decoy response.
+- **SRV-08**: `percent_decode` maps `+`→space (wrong in a URI path) and
+  per-byte→char (mojibake for non-ASCII filenames) — `decoy.rs:106-127`.
+  Fix with proper UTF-8 percent-decoding; also move the blocking
+  `is_dir()`/`is_file()` syscalls off the async path.
+- **SRV-09**: `/openapi.json` error path echoes raw serde internals to
+  unauthenticated callers and re-serializes the whole projection per
+  request (`adapter.rs:250-254`); companion unguarded
+  `.expect("to_openapi always emits…")` in `to_openapi.rs:67`. Cache the
+  serialized doc, return a generic 500 body, remove the `expect`.
+- **SRV-10**: WS upgrade hardcodes `NoCap` while the doc claims a
+  stricter policy is passable — add the injection point or fix the doc;
+  drop the double token resolution (router middleware + `ws_bearer_auth`).
+
+## Acceptance Criteria
+
+- [ ] Hyper configured with timer + header read timeout; knob values documented
+- [ ] 405 responses carry the decoy `Server` header (test with `OPTIONS /search`)
+- [ ] `%C3%A9` and `a+b.html` resolve correctly in the decoy static server (tests); async-path syscalls gone
+- [ ] `/openapi.json` 500 body is generic; doc cached; `expect` removed
+- [ ] Second `.with_decoy` no longer silently drops extra routes (test)
+- [ ] SRV-10: policy injection point exists or doc corrected; single token resolution
+- [ ] `cargo test`, `cargo test --all-features`, `cargo clippy --all-targets -- -D warnings` pass
+
+## References
+
+- docs/reviews/001-initial-implementation-review.md (Part A, SRV-04..SRV-10)
+- docs/architecture/decisions/010-alpn-router-and-endpoint.md
+
+## Notes
+
+> Agent fills during implementation. Independent of the other
+> review-001 tasks; can proceed in parallel.
+
+## Summary
+
+> Filled on completion.