fix: time out stalled upload bodies without timing merge execution

[beinan]

An upload that stops midway through its request body can keep a worker waiting during graceful shutdown. Add a configurable 120-second idle timeout for the next requested body frame and return HTTP 408 with a log/counter when it expires. Each received frame resets the timer; consumer backpressure and handler/merge/query execution are outside it.

The guard acts while the application consumes the body. It does not impose a deadline on merge execution or diagnose every blocked HTTP connection.

Validation:

• Reproduced the shutdown wait with the actual old production image in isolated Azure staging: partial JSON upload kept the signalled worker alive; completing the body produced 201 and exit 0.
• Five new regressions pass: a progressing 300-second upload, a 600-second handler after body consumption, 600-second consumer backpressure, unrelated body errors, and real TCP partial upload followed by joined graceful shutdown.
• Full server binary suite: 97 passed, 7 existing isolated-etcd tests ignored, 0 failed. CI Clippy, formatting, spelling, Python lint and wheel builds pass; remaining CI is running.