fix(v0.4.0, resource limits): registry cleanup, body cap, SO_TIMEOUT, conn cap, posix perms

[VirusAlex]

Summary

Closes audit findings HIGH H2 + cluster of medium resource-bound DoS issues. Third of ~5 PRs gating v0.4.0. No behaviour change for honest clients; only caps the worst case under hostile or long-lived workloads.

Changes

ManifestRegistry actually evicts now (H2)

Pre-v0.4.0 the eviction task was wired but App.boot never called startBackgroundCleanup, so manifests leaked forever despite the documented 24h TTL.

• App.java: manifestRegistry.startBackgroundCleanup(Duration.ofMinutes(15)).
• ManifestRegistry.MAX_ENTRIES = 10_000: when full, evict oldest in store(). Bounds memory under bursts without rejecting fresh manifests.

HTTP body size cap (medium)

• App.java: cfg.http.maxRequestSize = 64 MiB. Javalin 6.x default is ~1 MiB (too low for big-tree manifests). 64 MiB ≈ 300k entries — well above honest use, well below trivial-OOM territory.

WebSocket subscription cap per session (medium)

• ProgressWebSocket.MAX_SUBS_PER_SESSION = 256. Pre-v0.4.0 a single auth'd session could subscribe to 2³¹ transferIds, each one allocating a ProgressBus subscription.

POSIX perms on state files (medium)

• JsonJobStore: <state-dir>/jobs/ → rwx------, per-job *.json → rw-------. Job-state contains the full manifest with absolute paths and target subdirs — sensitive on multi-user hosts. Auto-no-op on Windows.

Shared HttpClient in RelayRoutes (medium)

• AtomicReference-cached singleton instead of HttpClient.newBuilder() per request. JDK 21+ HttpClient keeps two background selector threads alive until shutdown(); pre-v0.4.0 every relay/push leaked threads until GC reclaimed them.

TCP HELLO timeout (medium)

• TcpConnectionHandler.handle: virtual-thread watchdog force-closes the channel if HELLO doesn't arrive in 30s. SocketChannel blocking mode doesn't honour SO_TIMEOUT (Socket-level only), so the deadline is a watchdog. Closes the Slowloris-style "open TCP, send 1 byte, hold the FD" path.

TCP connection cap (medium)

• BlobTcpServer.MAX_CONCURRENT_CONNECTIONS = 1024. Drops new accepts over the limit at the app layer. With chunksPerFile=8, one honest peer holds ~8 sockets per active file → 1024 supports ~128 in-flight files concurrently.

Test plan

• Local mvn test → 361 tests, 0 failures, 56 errors all in the known Jetty-loopback Windows-env category. No new failures.
• CI green on Linux.
• Manual: leave a daemon running 24h with periodic POST /api/manifest; confirm registry size stays ≤ 10k and reaches steady state.
• Manual: open a TCP connection without sending HELLO; expect server to close after ~30s.
• Manual: ls -l <state-dir>/jobs/*.json on Linux → file mode -rw-------, dir drwx------.

🤖 Generated with Claude Code