fix: harden HTTP server and request handling

[schtobia]

This PR hardens the HTTP server against common abuse scenarios and tightens request handling on the sync endpoint.

Changes

• Configure explicit server timeouts (main.go): Replace the bare http.ListenAndServe call with an http.Server configured with ReadHeaderTimeout (10s), ReadTimeout (30s), WriteTimeout (60s), and IdleTimeout (120s). This mitigates Slowloris-style attacks and prevents connections from exhausting server resources by staying open indefinitely.
• Restrict /api/sync to POST (sync/handle.go): The sync handler now rejects non-POST requests with 405 Method Not Allowed instead of attempting to parse them as sync payloads.
• Remove redundant file close (sync/user_management.go): Drop the explicit destFile.Close() in the error path of AddKey; log.Fatalf terminates the process anyway, and the file handle is already managed by the deferred close.
• Minor cleanup: Grouped var declarations, fixed import ordering, and corrected indentation of the health handler.

Motivation

Running with Go's default http.Server settings means no timeouts at all, leaving the server vulnerable to slow-client resource exhaustion. Additionally, the sync endpoint accepted any HTTP method, which made request handling less strict than necessary. These changes improve robustness without altering the sync protocol or API behavior for legitimate clients.

Testing

• Verified the server starts and responds on /api/health as before.
• Confirmed GET /api/sync now returns 405 Method Not Allowed, while well-formed POST requests continue to sync successfully.

[schtobia]

sorry, this was a mistake