test(uploads): pin the deployed idle bound and its unavailable warning (#56)

Gatekeeper review of PR #63 (comment 15139):
- the 60 s default is what production runs (cmd/tapir never sets
  UploadIdleTimeout) and no test covered it; 1 ns, 60 ms or 24 h all left
  the suite green. Pinned via export_test.go, plus a socket test with the
  timeout unset that accepts a body with 100 ms gaps (60 ms mutant red).
- the "upload idle bound unavailable" warning, the only signal that the
  control did not apply, is now asserted (removing it goes red).
- the deadline clear on io.EOF was redundant (net/http resets the
  deadline before its background read) and is removed; ADR-033 text
  corrected (the part can end before the body, so "cleared on clean
  EOF" did not hold).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

DECISIONS.md

@@ -1465,9 +1465,12 @@ an hour of Swedish *was* an unknown here; it is now measured, see decision 8.)
    2026-10-04)**: a `ReadTimeout` would cut legitimate 200 MiB uploads on slow links, so instead
    every read of the upload body re-arms the connection's read deadline 60 s ahead
    (`App.UploadIdleTimeout`). A body that stops delivering bytes fails its read, Accept returns
-   and the slot is released; one that keeps moving is never cut. The deadline is cleared only on
-   a clean end of body and stays armed after an error, because net/http drains an unread
-   remainder before replying. It needs `http.ResponseController` to reach the connection, so the
+   and the slot is released; one that keeps moving is never cut. The handler never clears the
+   deadline: an armed deadline also bounds net/http's drain of an unread remainder before it
+   replies, and net/http resets it itself before its background read. A deadline still armed
+   while the file is probed (the multipart part can end before the body's last bytes arrive)
+   costs at most keep-alive reuse of that connection, not the upload. The 60 s default is the
+   deployed value (cmd/tapir does not set it) and is pinned by a test. It needs `http.ResponseController` to reach the connection, so the
    metrics middleware's writer implements `Unwrap`; where a deadline cannot be set the handler
    logs `upload idle bound unavailable` rather than silently running unbounded. Still not
    bounded: a body that drips one byte per 59 s holds its slot for as long as it keeps that up.