All 6 timeout values configurable via DB settings. Fallback to defaults confirmed for fresh installs. Path traversal defense verified (403 + logging). Fixed hardcoded duration references in timeout.go log output. 163 tests pass, no regressions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>