fix(proxy): bound first-byte wait to recover a hung model-worker (#13)

[Hrt-Htk]

Closes #13.

Problem

A hung model-worker child makes the llama.cpp router accept a completion and never respond. _do_forward awaited the upstream with timeout=None, so the proxy (and any pi/Claude client behind it) hung indefinitely. The existing dead-worker recovery only triggers on a router 5xx body (_is_dead_worker_response), but a hung worker produces silence, not a 5xx — so recovery was never reached.

Fix

Bound the wait for response headers (nginx proxy_read_timeout model) and route a timeout into the existing recovery path:

• FIRST_BYTE_TIMEOUT (default 60s, override $PROXY_FIRST_BYTE_TIMEOUT) — generous enough for a 15–25s cold model load.
• Wrap the initial session.request(...) in asyncio.wait_for; on timeout raise the existing DeadWorkerError → recover_worker → retry → 503.
• Guard the non-model path so a hung worker starving /v1/models etc. returns 503 instead of an uncaught error.
• Post-header streaming (25s per-chunk keep-alive) is unchanged — this only bounds time-to-first-response, not generation length.

Test (TDD)

tests/test_dead_worker_timeout.py drives the real proxy_request against a scripted mock router:

• hung (accept, never respond) — RED before the fix (hangs), GREEN after (503 + recover_worker called).
• slow cold-load (headers delayed under the timeout) — not tripped (guardrail: slow ≠ hung).
• healthy — passthrough.

Full suite: 23/23 pass.

Scope

Handles the no-headers-at-all hang (the 2026-07-19 incident). The headers-then-mid-stream-silence variant is still served indefinite keep-alives by the pre-existing loop (separate follow-up). Does not address the distinct empty-turn / degenerate-output problem (#14).

🤖 Generated with Claude Code