Remove ineffective global request limits

[behinddwalls]

Summary

Why?

The server exposed global concurrency and total request timeout settings without a safe way to apply them. Enforcing them around the whole router would queue health probes behind clones and terminate long streaming Git, LFS, and pack responses mid-transfer.

What?

Remove server.max_concurrent_requests and server.request_timeout, along with the unsafe middleware implementation and misleading documentation. Keep the existing per-repository Git concurrency limit, and reject the removed keys instead of silently accepting unsupported controls.

Test Plan

✅ cargo test -p walgit-config removed_global_request_limit_configuration_is_rejected

✅ cargo check -p walgit-server

✅ cargo clippy -p walgit-server --all-targets -- -D warnings

✅ cargo fmt --all -- --check

✅ git diff --check

Issue

Closes #78

Stack

1. Remove ineffective global request limits #86 — Remove ineffective global request limits

[0bserver07]

I ran this locally. Tests pass but clippy fails on middleware.rs:142 (manual_let_else), so CI would go red.

Two things worried me more though. The limit wraps every route, so /healthz and /readyz have to wait in line behind clones once it's full, which can fail liveness checks under load and keeps the 503 from getting out while draining. And since the permit and the timeout stay on the response body, request_timeout would now cut off long clones and big LFS or packfile downloads halfway through. It was a no-op before, with a 1h default.

Maybe limit only git and LFS work, answer 503 with Retry-After when full, and time out on idle instead of total time? Or just delete the two keys like #78 also suggests. A saturation test would help either way.

[behinddwalls]

Removed the unsafe global request controls in c7ab81a while retaining the existing per-repository Git concurrency limit. Applying the controls around the full router would queue health probes behind clones and terminate long streaming Git, LFS, and pack responses, so the unsupported keys are now removed and rejected. The configuration regression test, server check, and clippy pass.

[addressed by agent]