fix(websocket): configurable WS read idle timeout (WS-01)

src/server/state.rs

@@ -40,6 +40,8 @@ pub(crate) struct RouterState {
     /// once at construction — the upgrade handler acquires one permit
     /// per upgrade and holds it for the session's lifetime.
     pub(crate) ws_session_slots: Arc<tokio::sync::Semaphore>,
+    /// Idle-read timeout for the WS pumps (WS-01); `None` disables.
+    pub(crate) ws_idle_timeout: Option<std::time::Duration>,
 }
 
 impl axum::extract::FromRef<RouterState> for crate::websocket::SessionState {
@@ -48,6 +50,7 @@ impl axum::extract::FromRef<RouterState> for crate::websocket::SessionState {
             Arc::clone(&state.registry),
             Arc::clone(&state.ws_sessions),
             Arc::clone(&state.ws_session_slots),
+            state.ws_idle_timeout,
         )
     }
 }
@@ -98,6 +101,7 @@ mod tests {
             ws_session_slots: Arc::new(tokio::sync::Semaphore::new(
                 crate::websocket::DEFAULT_WS_MAX_SESSIONS,
             )),
+            ws_idle_timeout: Some(crate::websocket::DEFAULT_WS_IDLE_TIMEOUT),
         };
         let extracted: DecoyConfig = axum::extract::FromRef::from_ref(&state);
         assert!(matches!(extracted, DecoyConfig::Redirect { .. }));