fix(report-api): cap static file transfer time at 1 minute

[max-ostapenko]

Summary

Limits how long a single /v1/static/* transfer can run: 1 minute by default, configurable with STATIC_MAX_TRANSFER_MS.

Problem

On 09-27 a slow bot (AtlasBot) downloaded /v1/static/almanac/ebooks/web_almanac_2022_en.pdf through the GCS proxy. The request stayed open until Cloud Run's 3600s timeout killed it, and it was logged as a 502. The proxy's existing req.setTimeout(60000) only fires when the socket is idle, so a client that keeps reading slowly never hits it.

Change

• proxyReportsFile starts a timer when streaming begins. If the transfer is still running when it fires, the timer logs a WARNING with the object path and destroys the GCS read stream. pipeline then closes the response. Headers have already been sent at that point, so the client sees a truncated download rather than an error status.
• The timer is cleared when the transfer finishes, and unref'd so it never keeps the process alive.
• The 120s idle timeout is unchanged.

The largest files served today are the Web Almanac ebooks (~10 MB). Those take seconds on a normal connection, so 1 minute only affects clients that are very slow or stalled.

Tests

• Added a test with a GCS stream that sends one chunk and then stalls. With the cap, the stream is destroyed within the 100ms limit. Without it, the request hangs until the test times out.
• report-api: 121/121 tests pass, lint clean.