test(infra): cover review-002 stream/PEM/cap error arms + drop dead WsTimeouts Default

- forward_stream build-error arm (forward.rs): wire-level test asserts
  one INVALID_INPUT envelope then stream end with zero upstream
  contact (a panicking responder counts as the contact guard), plus
  the from_jsonschema integration mirror (undeclared key + non-scalar
  placeholder, each naming its rejection source)
- PEM read-failure arms (http_client.rs): nonexistent CA path →
  CaBundleRead (sync new), nonexistent client-cert path → ClientCertRead
  (async reload, prior generation retained)
- Over-cap poll_write rejection leg (byte_adapter.rs): cap+1 write →
  InvalidData naming the cap; stream stays usable for an at-cap write
  afterwards
- SSE parser edges: CRLF split across feed chunks frames one line;
  invalid-UTF8 data lines drop without killing the frame stream
- from_value structural rejects: non-object doc, missing `info`,
  missing `paths`, non-object `paths` each name the member
- Connection-failure arms: accept-path ConnectionClosed →
  HandlerError::ConnectionClosed via stream_error_to_handler; read-pump
  demux-gone break ends the pump when the byte-stream side is dropped
- Delete the caller-less `impl Default for WsTimeouts` (the extension
  is constructed explicitly)

cargo llvm-cov --all-features: all named arms covered; TOTAL regions
94.18% (was 93.86%), lines 96.04% (was 95.77%); http_client.rs
86.56% lines (was 81.72%).

docs(tasks): mark review-002-fu-stream-error-coverage done

src/server/adapter.rs

@@ -765,6 +765,29 @@ mod tests {
         let _ = server_task.await;
     }
 
+    /// The accept-path connection-failure arm: a `Connection` whose
+    /// single underlying stream is already gone (closed by the dial
+    /// side) yields `StreamError::ConnectionClosed` from `accept_bi`,
+    /// which `stream_error_to_handler` maps to
+    /// `HandlerError::ConnectionClosed` — the error the consumer's
+    /// accept loop observes for a peer that died before the first
+    /// stream arrived.
+    #[tokio::test]
+    async fn accept_bi_failure_maps_to_handler_error_connection_closed() {
+        let adapter = HttpAdapter::new(provider(), empty_registry());
+        let (client, server) = tokio::io::duplex(64 * 1024);
+        let conn = Connection::from_bidi(server, b"http/1.1".to_vec(), None);
+        let auth = AuthContext::anonymous(b"http/1.1");
+
+        drop(client);
+        conn.close(0, "gone before the first stream");
+        let result = ProtocolHandler::handle(&adapter, conn, &auth).await;
+        match result {
+            Err(HandlerError::ConnectionClosed) => {}
+            other => panic!("expected HandlerError::ConnectionClosed, got {other:?}"),
+        }
+    }
+
     #[tokio::test]
     async fn healthz_served_by_the_adapter_over_duplex() {
         let adapter = HttpAdapter::new(provider(), empty_registry());