[Security][LOW] Server-Timing header exposes internal processing duration

## Summary

Harper adds a `Server-Timing: hdb;dur=X.XX` header to all responses by default, revealing per-request internal processing time to any observer.

**Example:**
```
Server-Timing: hdb;dur=3.14
```

## Risk

- Timing data can be used for enumeration (e.g. distinguishing valid vs. invalid records or users by response latency).
- Expensive operations become visible, making it easier for an attacker to identify high-cost paths for DoS targeting.

## Recommendation

Make the `Server-Timing` header opt-in rather than on by default, or disable it when Harper is not in a development/debug mode. If useful for internal performance monitoring, consider exposing it only to authenticated requests or via a config flag in `harperdb-config.yaml` (e.g. `http.serverTiming: false`).

## Severity

**Low** — indirect risk; primarily useful as an aid to other attacks rather than an exploit in its own right.