chore: implement Phase 1 and 2 security remediations

backend/handlers/httpclient.go

@@ -0,0 +1,19 @@
+package handlers
+
+import (
+	"net/http"
+	"time"
+)
+
+// SafeHTTPClient is a shared client for all outbound requests.
+// It enforces timeouts and prevents indefinite hangs.
+var SafeHTTPClient = &http.Client{
+	Timeout: 30 * time.Second,
+	Transport: &http.Transport{
+		TLSHandshakeTimeout:   10 * time.Second,
+		ResponseHeaderTimeout: 15 * time.Second,
+		IdleConnTimeout:       30 * time.Second,
+		MaxIdleConns:          10,
+		DisableKeepAlives:     false,
+	},
+}