Make proxy request read timeout configurable

[Sanskarzz]

Summary

Proxy HTTP servers currently protect against slow or stalled request uploads with a fixed 30-second read timeout.
That secure default cannot be adjusted for workloads that legitimately need more time, or tightened for environments that
want a shorter limit.

• Add thv run --proxy-read-timeout and MCPServer spec.proxyReadTimeout configuration.
• Persist the setting as a unit-explicit Go duration string in RunConfig and validate malformed or negative values before the proxy starts.
• Thread positive overrides through the existing transport factory to the streamable, SSE, and transparent proxy implementations.
• Preserve the existing 30-second default when the value is omitted or zero, so zero never disables slow-upload protection.
• Update the architecture documentation, generated CLI/API references, OpenAPI output, and operator CRD manifests.

Fixes #5503

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)
• Build (task build)
• Operator integration tests (task operator-test-integration)

Generated artifacts were refreshed with task operator-generate,
task operator-manifests, task crdref-gen, and task docs.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

The MCPServer API change is additive and optional. Existing resources continue to use the proxy's 30-second default.

Changes

File	Change
cmd/thv/app/run_flags.go	Add the --proxy-read-timeout CLI flag and RunConfig builder wiring.
pkg/runner/{config.go,config_builder.go,runner.go}	Add the RunConfig field, normalize builder input, and validate persisted duration strings.
pkg/transport/{types/transport.go,factory.go,stdio.go,http.go}	Carry the timeout through the existing transport configuration and proxy option paths.
cmd/thv-operator/api/v1beta1/mcpserver_types.go	Add the optional duration field and reject negative values at admission.
cmd/thv-operator/controllers/mcpserver_runconfig.go	Translate the MCPServer field into the shared RunConfig contract.
Tests	Cover builder/runtime validation, transport propagation, CRD translation, and Kubernetes admission behavior.
Docs and generated artifacts	Document the setting and refresh CLI, OpenAPI, CRD, deepcopy, and operator API output.

Does this introduce a user-facing change?

Yes. CLI users can set thv run --proxy-read-timeout <duration>, and Kubernetes users can set MCPServer.spec.proxyReadTimeout.
Both accept Go duration values such as 45s or 2m. Omitting the setting or specifying zero retains the 30-second default.

Implementation plan

Approved implementation plan

1. Add CLI and MCPServer API inputs using existing duration conventions.
2. Store the value in the shared RunConfig contract as a Go duration string.
3. Validate and parse the value at the builder, Kubernetes admission, and
   persisted RunConfig boundaries.
4. Pass the resolved duration through transport.Config and the existing
   transport factory to each proxy's typed WithReadTimeout option.
5. Keep proxy constructors as the source of the 30-second default and omit the
   option for zero values.
6. Add focused unit and operator integration coverage, then regenerate the
   affected documentation and CRD/OpenAPI artifacts.

Special notes for reviewers

• This builds on the proxy-level read timeout protection added by Add request timeouts to MCP proxy servers #5501; it configures the existing implementation rather than adding another timeout
  mechanism.
• The setting bounds reading request headers and bodies. It does not configure WriteTimeout, so long-lived SSE responses remain unaffected.
• Zero intentionally means "use the secure default," not "disable the timeout."
• The management API and thv mcp serve retain their independent timeout behavior.

[codecov]

Codecov Report

❌ Patch coverage is 77.14286% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.86%. Comparing base (c503322) to head (f6df8b5).

Files with missing lines	Patch %	Lines
pkg/transport/stdio.go	33.33%	4 Missing ⚠️
pkg/runner/runner.go	84.61%	1 Missing and 1 partial ⚠️
pkg/transport/http.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6285      +/-   ##
==========================================
- Coverage   72.86%   72.86%   -0.01%     
==========================================
  Files         742      742              
  Lines       77807    77842      +35     
==========================================
+ Hits        56694    56716      +22     
- Misses      17141    17152      +11     
- Partials     3972     3974       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.