[phildenhoff]

Replaces #154. Retains the original implementation's author credit; the legacy native stack prevents retargeting the original PR.

Bound catalog resource use across every listener without interrupting slow book downloads.

• Add a shared 64-request pool retained through response-body completion/disconnect, a separate 64-slot blocking-work pool, a 16 KiB body cap (including chunked bodies), and 30-second feed deadlines.
• Keep blocking-work permits inside jobs so cancelling a timed-out waiter cannot admit an unbounded queue. Retain streaming-worker permits until the worker finishes.
• Return 503 with Retry-After on overload and distinguish permission-denied binds from occupied ports.
• Preserve current constant-time authentication, exponential backoff and live credential swaps. The old Argon2/cache changes and one-time-password UI copy are obsolete and omitted.

Tests cover shared admission/body lifetime, blocking-job cancellation, oversized declared/chunked bodies, slow successful asset responses, permission errors and HTTP traversal attempts. Downloads have no feed deadline. These middleware bounds start after headers; slow-header/accepted-connection limits remain outside this implementation.

Stack: #183 → #184. #185, #181 and #182 are merged. #183 targets main.

Validation after rebasing onto merged #182: runtime/server tests, bun lint, bun format:check, and bun run typecheck passed. CI is running on the updated head.

Known catalog follow-ups from #182 remain separate: return facet identity and data atomically during desktop library switches; advertise root start/up links as navigation feeds. This PR bounds resource use and does not change those catalog semantics.

[github-actions]

libcalibre Test Coverage Report

Overall coverage: 84.79%

📊 Download HTML Report

Coverage breakdown available in the artifacts.

[linear-code]

CDL-26

CDL-27

CDL-20