Fix HTTP client, binary protocol, and graceful shutdown issues

[fujiwara]

What

Fixes for issues found in a code review:

1. HTTPClient ignored pathPrefix: NewHTTPClient did not assign the parameter, so clients could not reach servers configured with HTTPPathPrefix.
2. HTTPClient mutated shared URLs: Fetch/FetchMulti rewrote the shared *url.URL in place, a data race under concurrent calls, and the n= query set by FetchMulti leaked into subsequent Fetch requests. Now operates on a copy.
3. GET /ids accepted invalid n: a negative n caused a panic by make() with a negative capacity, and n=0 returned an empty response. n out of 1-1000 is now rejected with 400.
4. Binary protocol error responses: a failed binary GET responded with the text protocol ERROR line, which binary clients cannot parse. Error responses are now proper binary headers and echo the requested opcode/opaque. Also fixed a meaningless short write check.
5. Binary request body size limit and slicing overflow: a malformed header with bodyLen=0xFFFFFFFF could trigger a 4GiB allocation per request, and keyLen+extraLen overflowing uint16 caused a panic that crashed the process. Bodies are now limited to 64KB and the index math is done in int.
6. Graceful shutdown: the HTTP server passed the already-canceled context to Shutdown (returning immediately without draining), and the gRPC server used Stop which kills in-flight RPCs. Both now drain in-flight requests with a 10s timeout (ShutdownTimeout), and RunHTTPServer/RunGRPCServer wait until the shutdown completes.
7. Invalid environment variable values: values like KATSUBUSHI_PORT=abc were silently ignored. The process now exits with an error, consistent with how flag.Parse handles invalid commandline values.

Behavior changes

• GET /ids?n=0 returned 200 with an empty body, now returns 400.
• Binary protocol error responses now echo the requested opcode instead of a fixed GET opcode.
• Startup fails on invalid environment variable values instead of silently using the default.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses several correctness and operational issues across the HTTP client/server, binary (memcached) protocol handling, graceful shutdown behavior, and configuration via environment variables.

Changes:

• Fix HTTP client path prefix handling and eliminate shared url.URL mutation in Fetch/FetchMulti; add related tests and validate GET /ids?n= range (1–1000).
• Improve graceful shutdown behavior for HTTP and gRPC servers with a bounded drain timeout and completion waiting.
• Harden binary protocol error responses and add a request body size limit; add tests for error responses and oversized bodies; make invalid env var values fail fast.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Documents the n parameter constraints for GET /ids.
http.go	Adds graceful HTTP shutdown waiting, validates n, fixes HTTP client pathPrefix usage and URL mutation.
http_test.go	Adds tests for invalid n, pathPrefix handling, and URL isolation/concurrency behavior.
grpc.go	Adds graceful gRPC shutdown with timeout and waits for shutdown completion.
cmd/katsubushi/main.go	Makes invalid env var values for flags fail fast (exit code 2) via applyEnvToFlag.
cmd/katsubushi/main_test.go	Adds test coverage for invalid env var flag values.
binary_protocol.go	Adds binary request body size limit and makes binary error responses echo opcode/opaque.
binary_protocol_test.go	Adds tests for too-large binary request bodies and binary error response shape.
app.go	Introduces ShutdownTimeout constant used by HTTP/gRPC graceful shutdown paths.
app_test.go	Updates binary error response expectations to echo requested opcode.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[fujiwara]

Good catch — the overflow was reachable (keyLen=65535, extraLen=1 passes both length checks and panics on slicing, crashing the process since there is no recover in the connection goroutine). Fixed in 0d53ff5 by calculating the indexes in int, with a regression test that reproduces the panic on the old code. Kept keys over 250 bytes accepted since katsubushi ignores key contents.