Security: set explicit HTTP server timeouts (CWE-400 / slowloris)

**Severity:** Medium
**Files:** `web/mudzipserver.go`

`router.Run(":8085")` uses default `http.Server` with zero `ReadTimeout`, `WriteTimeout`, `IdleTimeout`, and `ReadHeaderTimeout`. Slow-body / slow-header attackers can tie up goroutines indefinitely.

### Remediation
Construct an explicit server:

```go
srv := &http.Server{
Addr: ":8085",
Handler: router,
ReadHeaderTimeout: 5 * time.Second,
ReadTimeout: 15 * time.Second,
WriteTimeout: 30 * time.Second,
IdleTimeout: 60 * time.Second,
}
log.Fatal(srv.ListenAndServe())
```

**Refs:** CWE-400.