All 6 timeout values configurable via DB settings.
Fallback to defaults confirmed for fresh installs.
Path traversal defense verified (403 + logging).
Fixed hardcoded duration references in timeout.go log output.
163 tests pass, no regressions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>