Added the HTTP server and serve command, with proxy, CSRF, TLS and security header config; wsserve is now ws serve, alongside a new ws dial

The serve command runs internal/server: the API under /api (health, and
the CSRF token endpoint) and the WebSocket hub under /ws, over HTTP or TLS,
with an optional HTTP to HTTPS redirect, the PROXY protocol from trusted
sources and a graceful shutdown that closes WebSockets first. Its middleware
covers the client IP behind trusted proxies, request IDs, request logging,
panic recovery, global and API rate limits, Host and body size checks,
security response headers, compression, CSRF protection (cross-origin
checks and signed double-submit tokens) and JSON-only API bodies. Middleware
that logs takes a WithLogger option.

New server config sections: proxy, csrf, tls, headers and frontend (not
used yet), plus max_header_bytes, max_body_bytes, global and API rate limits
and HTTP read, write and idle timeouts. Every setting documents what 0 or
empty means, and internal/config/README.md is reorganised by section.
server.timeouts.read_header must be greater than 0, and a header or idle
timeout of 0 means no limit rather than the read timeout.

WebSocket upgrades are protected by the Origin check: the server's own
origin, or one of csrf.cross_origin_protection.trusted_origins, which the
hub now takes with WithTrustedOrigins.

wsserve becomes "ws serve". "ws dial" opens a WebSocket on /ws to test it:
--ping sends a ping and waits for the pong, --message sends messages and
prints the replies, --origin tests the Origin check, and with neither
--ping nor --message each line of stdin is sent until Ctrl+C.

internal/config/conf_sections_test.go

@@ -372,6 +372,18 @@ func TestSerialisedRoundTrip(t *testing.T) {
 	orig.Sources.FTSMock.Enabled = true
 	orig.Sources.FTSMock.APIRoot = "http://mock"
 	orig.Server.WebSocket.MaxMessageSize = 64 << 10
+	orig.Server.MaxBodyBytes = 2 << 20
+	orig.Server.Headers.ExtraResponseHeaders = []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+		{
+			Header: "Cache-Control",
+			Value:  "no-store, max-age=0",
+		},
+	}
+	orig.Server.Headers.RemoveResponseHeaders = []string{"Server", "X-Powered-By"}
 
 	for _, format := range []string{"json", "yaml"} {
 		t.Run(format, func(t *testing.T) {
@@ -449,6 +461,12 @@ func TestViperRoundTrip(t *testing.T) {
 	orig.Logging.Level = "error"
 	orig.Sources.FindATender.Enabled = true
 	orig.Sources.FindATender.Interval = 45 * time.Second
+	orig.Server.Headers.ExtraResponseHeaders = []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
 	LoadToViper(orig)
 
 	var got JobSearchConfig
@@ -458,6 +476,98 @@ func TestViperRoundTrip(t *testing.T) {
 	}
 }
 
+// A list of sections can be given as a JSON array string, as it would be in
+// an environment variable.
+func TestLoadFromViperSectionListString(t *testing.T) {
+	resetViper(t)
+	viper.Set(
+		"server.headers.extra_response_headers",
+		`[{"header": "X-Robots-Tag", "value": "noindex"}]`,
+	)
+	conf := defaultConfig(t)
+	LoadFromViper(&conf)
+
+	want := []JSCServerHeadersExtra{
+		{
+			Header: "X-Robots-Tag",
+			Value:  "noindex",
+		},
+	}
+	if !reflect.DeepEqual(conf.Server.Headers.ExtraResponseHeaders, want) {
+		t.Errorf(
+			"ExtraResponseHeaders = %+v; want %+v",
+			conf.Server.Headers.ExtraResponseHeaders,
+			want,
+		)
+	}
+}
+
+func TestHeadersExtraValidation(t *testing.T) {
+	var c JSCServerHeadersExtra
+	for _, h := range []string{"X-Robots-Tag", "x-a", "A1!#$%&'*+-.^_`|~"} {
+		if err := c.SetValue("header", h); err != nil || c.Header != h {
+			t.Errorf("SetValue(header, %q) = %v, Header = %q", h, err, c.Header)
+		}
+	}
+	for _, h := range []string{
+		"", "X Robots", "X-A:", "X-A\r\nX-B", "Ünicode", "(x)",
+	} {
+		if err := c.SetValue("header", h); err == nil ||
+			!strings.Contains(err.Error(), "invalid header name") {
+			t.Errorf("SetValue(header, %q) = %v; want invalid header name", h, err)
+		}
+	}
+	if err := c.SetValue("value", "no-store, max-age=0"); err != nil {
+		t.Errorf("SetValue(value): %v", err)
+	}
+	for _, v := range []string{"a\nb", "a\rb", "a\r\nX-Evil: 1"} {
+		if err := c.SetValue("value", v); err == nil ||
+			!strings.Contains(err.Error(), "invalid header value") {
+			t.Errorf("SetValue(value, %q) = %v; want invalid header value", v, err)
+		}
+	}
+
+	// Items in the list are validated whole, so a missing header is rejected
+	// too, and the list is left as it was.
+	const key = "server.headers.extra_response_headers"
+	conf := defaultConfig(t)
+	for _, value := range []any{
+		`[{"value": "noindex"}]`,
+		`[{"header": "X-A", "value": "1"}, {"header": "bad name", "value": "2"}]`,
+		`[{"header": "X-A", "value": "a\nb"}]`,
+		[]JSCServerHeadersExtra{
+			{
+				Value: "noindex",
+			},
+		},
+	} {
+		if err := conf.SetValue(key, value); err == nil ||
+			!strings.Contains(err.Error(), "invalid header") {
+			t.Errorf("SetValue(%s, %#v) = %v; want invalid header", key, value, err)
+		}
+		if conf.Server.Headers.ExtraResponseHeaders != nil {
+			t.Errorf(
+				"rejected list was stored: %+v",
+				conf.Server.Headers.ExtraResponseHeaders,
+			)
+		}
+	}
+
+	// From Viper, an invalid list is skipped with a warning.
+	resetViper(t)
+	logs := captureLogs(t, slog.LevelWarn)
+	viper.Set(key, []any{map[string]any{"value": "noindex"}})
+	LoadFromViper(&conf)
+	if conf.Server.Headers.ExtraResponseHeaders != nil ||
+		!strings.Contains(logs.String(), "key="+key) {
+		t.Errorf(
+			"invalid list from Viper: stored %+v, logs %s",
+			conf.Server.Headers.ExtraResponseHeaders,
+			logs,
+		)
+	}
+}
+
 // Invalid values from Viper are skipped with a warning, leaving the existing
 // value.
 func TestLoadFromViperInvalidValues(t *testing.T) {
@@ -620,3 +730,26 @@ func TestSourceIntervalMustBePositive(t *testing.T) {
 		)
 	}
 }
+
+// server.timeouts.read_header must be greater than 0; the other server
+// timeouts accept 0 (no limit).
+func TestServerReadHeaderTimeoutMustBePositive(t *testing.T) {
+	conf := defaultConfig(t)
+	for _, value := range []string{"0s", "-1s"} {
+		err := conf.SetValue("server.timeouts.read_header", value)
+		if err == nil || !strings.Contains(err.Error(), "greater than 0") {
+			t.Errorf("SetValue(read_header, %s) = %v; want rejected", value, err)
+		}
+	}
+	if conf.Server.Timeouts.ReadHeaderTimeout != 5*time.Second {
+		t.Errorf(
+			"rejected read_header was stored: %v",
+			conf.Server.Timeouts.ReadHeaderTimeout,
+		)
+	}
+	for _, key := range []string{"read", "write", "idle", "shutdown"} {
+		if err := conf.SetValue("server.timeouts."+key, "0s"); err != nil {
+			t.Errorf("SetValue(%s, 0s): %v", key, err)
+		}
+	}
+}