feat: add response controller middleware

[franklinkim]

Description

Add ResponseController and MaxRequestBodySize HTTP middlewares, and raise the server IdleTimeout to 620s.

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 💥 Breaking change
• 📝 Documentation
• ♻️ Refactoring
• 🏃‍➡️ Performance
• ✅ Tests
• 🔐 Security
• 🔧 Build/CI

Changes

• middleware.ResponseController(h) — runs h against the request's http.ResponseController before the handler, so read/write deadlines, full duplex and flush can be overridden per connection (e.g. clearing the write deadline for SSE). An error from h is logged and the handler still runs.
• middleware.MaxRequestBodySize(n) — rejects a declared Content-Length over n with 413 before the handler runs, and wraps the body in http.MaxBytesReader so chunked or lying clients fail on read with *http.MaxBytesError.
• net/http/server.go — IdleTimeout 120s → 620s so the peer is always the side closing an idle connection; comment documents the managed-L7 values it clears (GCLB 600s, Azure App Gateway 240/300s, ingress-nginx 60s, ALB 60s) and the Envoy-sidecar caveat.
• Table-driven tests for both middlewares.

Checklist

• My code adheres to the coding and style guidelines of the project.
• I have performed a self-review of my own code.
• I have commented on my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.