Add TLS handshake timeout (review #010 C3)

tls_handshake_timeout_secs (default 10s, must be > 0) wraps
tls_acceptor.accept() in tokio::time::timeout so stalled handshakes
(slowloris / crawler slow-handshake vector) can no longer hold an FD +
semaphore permit indefinitely. Config plumbing through FullConfig /
StaticConfig / validation / reload diff + docs.

docs/architecture/config.md

@@ -91,6 +91,7 @@ Immutable after startup. Changes require a process restart.
 | `admin_key_path` | `String` | Path to file containing the admin Bearer token (default: `/etc/reverse-proxy/admin-key`; empty string to disable admin endpoints; see ADR-028) |
 | `shutdown_timeout_secs` | `u64` | Maximum seconds to wait for in-flight requests during graceful shutdown (default: `30`) |
 | `connection_idle_timeout_secs` | `u64` | Server-side idle timeout for client TLS connections. Idle HTTP/2 connections are closed after this duration (with keep-alive pings at 15s intervals to detect dead peers). HTTP/1.1 connections are closed if the client doesn't send a complete request header within this duration. Prevents FD exhaustion from abandoned connections (default: `60`; must be > 0; see review #007 C1) |
+| `tls_handshake_timeout_secs` | `u64` | Maximum seconds a client may take to complete the TLS handshake. Stalled handshakes (e.g. crawlers/slowloris clients that open a TCP connection but never send a ClientHello) are closed after this duration, releasing the FD and connection slot. Without it, a stalled handshake holds an FD + connection semaphore permit indefinitely (default: `10`; must be > 0; see review #010 C3) |
 | `max_connections` | `usize` | Maximum number of concurrent client TLS connections. When the limit is reached, new connections wait in the OS TCP backlog until a slot frees (default: `1024`; must be > 0; see review #007 C2) |
 | `logging` | `LoggingConfig` | Logging configuration (see below) |
 
@@ -185,6 +186,7 @@ Phase 2.
 | `admin_key_path` | `String` | `/etc/reverse-proxy/admin-key` | No |
 | `shutdown_timeout_secs` | `u64` | `30` | No |
 | `connection_idle_timeout_secs` | `u64` | `60` | No |
+| `tls_handshake_timeout_secs` | `u64` | `10` | No |
 | `max_connections` | `usize` | `1024` | No |
 | `logging.level` | `String` | `"info"` | No |
 | `logging.format` | `String` | `"text"` | No |
@@ -313,6 +315,7 @@ certificate:
 health_check_port = 9900     # Local health check (0 to disable)
 admin_key_path = "/etc/reverse-proxy/admin-key"  # Empty string to disable
 # connection_idle_timeout_secs = 60  # Server-side idle timeout (default: 60)
+# tls_handshake_timeout_secs = 10     # TLS handshake timeout (default: 10)
 # max_connections = 1024              # Max concurrent TLS connections (default: 1024)
 
 [logging]
@@ -461,6 +464,9 @@ On startup, the config is validated:
      review #007 C1.
 22. `max_connections` must be > 0. A zero value would deadlock the connection
      semaphore, preventing any client connection from being accepted.
+23. `tls_handshake_timeout_secs` must be > 0. A zero value would immediately
+     kill every TLS handshake, preventing any client connection from
+     completing (review #010 C3).
 
 On SIGHUP reload, the same validation applies. If the new config fails
 validation, the reload is rejected and the old config remains active. An error