feat(http): outbound HTTP capability gateway with enforced deadlines

Zig 0.15's std.http.Client.fetch has no timeout and owns its socket, so a
hung VeriSimDB/Steam/Groove endpoint blocked the calling thread forever and
the STEAM_API_TIMEOUT_MS / GROOVE_TIMEOUT_MS constants were inert.

Following the estate's http-capability-gateway direction ("HTTP verbs/routes
become declared capabilities, not accidents" — one policy-driven mediation
layer), this applies the same idea to GSA's OUTBOUND calls. New
src/interface/ffi/src/http_capability.zig is the ONLY caller of fetch in the
FFI layer; every call site declares an OutboundCapability (verb, host_allow,
deadline_ms, purpose/narrative, label, trust — names mirror the gateway DSL)
and call() enforces a host allow-list (default-deny) and a hard wall-clock
deadline.

Deadline mechanism (fetch cannot be cancelled): a worker thread runs the
opaque fetch; the caller waits on std.Thread.Semaphore.timedWait(deadline).
This bounds the caller uniformly for plain HTTP and TLS (Steam) alike, since
it sits above fetch. Ownership is a 2-count refcount on a shared RequestBox
backed by c_allocator (malloc — thread-safe, process-lifetime), so a worker
that outlives a timed-out caller never touches a transient allocator; the
last releaser frees, with no write-after-free and no leak. A bounded
MAX_OUTSTANDING worker cap fails fast (Backpressure) rather than piling up
blocked threads — the client-side echo of the gateway's circuit breaker.

- verisimdb/steam/groove clients: all four fetch sites collapse to one call();
  their http.Client fields are removed (the worker owns a fresh client). The
  three timeout constants (+ new VERISIMDB_TIMEOUT_MS) are now load-bearing.
  A deadline hit maps to probe_timeout; other failures keep their codes. No
  new GsaResult variant, so no Types.idr/ABI regen.
- MockHTTP added to the harness (respond_ok / never_respond / slow_respond);
  its teardown closes held sockets so abandoned workers unblock and drain
  (http_capability.waitQuiescent) before the leak check.
- 5 behavioral tests: hung endpoint returns within the deadline (not forever),
  happy-path body, slow-respond passes/fails by deadline, default-deny without
  a socket, host-allow matching. 167 tests green across six suites + 104 fuzz.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

Author: claude

src/interface/ffi/src/groove_client.zig

@@ -23,6 +23,7 @@ const std = @import("std");
 const http = std.http;
 const Allocator = std.mem.Allocator;
 const main = @import("main.zig");
+const http_capability = @import("http_capability.zig");
 
 // ═══════════════════════════════════════════════════════════════════════════════
 // Constants
@@ -40,10 +41,8 @@ const GROOVE_TTS_PATH: []const u8 = "/.well-known/groove/tts";
 /// Maximum number of Groove targets we track simultaneously.
 const MAX_TARGETS: usize = 8;
 
-/// Intended per-request deadline for Groove probes (milliseconds). NOT yet
-/// enforced — Zig 0.15.2's std.http.Client has no timeout knob, so a hung
-/// endpoint blocks the caller. Wiring it (raw-socket client or watchdog thread)
-/// is a tracked follow-up; kept as the contract to honour.
+/// Per-request deadline for Groove calls (ms) — enforced via the outbound HTTP
+/// capability gateway (http_capability.call).
 const GROOVE_TIMEOUT_MS: u32 = 3000;
 
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -177,30 +176,24 @@ fn grooveGet(
 ) ![]const u8 {
     var url_buf: [512]u8 = undefined;
     const url_str = std.fmt.bufPrint(&url_buf, "http://{s}:{d}{s}", .{ host, port, path }) catch return error.URLTooLong;
-
-    var client = http.Client{ .allocator = allocator };
-    defer client.deinit();
-
-    var alloc_writer = std.Io.Writer.Allocating.init(allocator);
-    errdefer alloc_writer.deinit();
-
-    const result = try client.fetch(.{
-        .location = .{ .url = url_str },
-        .method = .GET,
+    var auth_buf: [320]u8 = undefined;
+    const authority = std.fmt.bufPrint(&auth_buf, "{s}:{d}", .{ host, port }) catch return error.URLTooLong;
+
+    const resp = try http_capability.call(allocator, .{
+        .verb = .GET,
+        .url = url_str,
+        .host_allow = &.{authority},
+        .deadline_ms = GROOVE_TIMEOUT_MS,
+        .purpose = "groove voice/text discovery",
+        .label = "groove",
+        .trust = .internal,
         .extra_headers = &.{
             .{ .name = "Accept", .value = "application/json" },
             .{ .name = "User-Agent", .value = "GSA-Groove/0.1.0" },
         },
-        .response_writer = &alloc_writer.writer,
+        .accept = &.{.ok},
     });
-
-    if (result.status != .ok) {
-        alloc_writer.deinit();
-        return error.HTTPError;
-    }
-
-    var list = alloc_writer.toArrayList();
-    return list.toOwnedSlice(allocator);
+    return resp.body;
 }
 
 /// Perform an HTTP POST against a Groove endpoint with a JSON body.
@@ -214,32 +207,26 @@ fn groovePost(
 ) ![]const u8 {
     var url_buf: [512]u8 = undefined;
     const url_str = std.fmt.bufPrint(&url_buf, "http://{s}:{d}{s}", .{ host, port, path }) catch return error.URLTooLong;
-
-    var client = http.Client{ .allocator = allocator };
-    defer client.deinit();
-
-    var alloc_writer = std.Io.Writer.Allocating.init(allocator);
-    errdefer alloc_writer.deinit();
-
-    const result = try client.fetch(.{
-        .location = .{ .url = url_str },
-        .method = .POST,
-        .payload = body,
+    var auth_buf: [320]u8 = undefined;
+    const authority = std.fmt.bufPrint(&auth_buf, "{s}:{d}", .{ host, port }) catch return error.URLTooLong;
+
+    const resp = try http_capability.call(allocator, .{
+        .verb = .POST,
+        .url = url_str,
+        .host_allow = &.{authority},
+        .deadline_ms = GROOVE_TIMEOUT_MS,
+        .purpose = "groove voice/text alert",
+        .label = "groove",
+        .trust = .internal,
+        .body = body,
         .extra_headers = &.{
             .{ .name = "Content-Type", .value = "application/json" },
             .{ .name = "Accept", .value = "application/json" },
             .{ .name = "User-Agent", .value = "GSA-Groove/0.1.0" },
         },
-        .response_writer = &alloc_writer.writer,
+        .accept = &.{ .ok, .created, .accepted },
     });
-
-    if (result.status != .ok and result.status != .created and result.status != .accepted) {
-        alloc_writer.deinit();
-        return error.HTTPError;
-    }
-
-    var list = alloc_writer.toArrayList();
-    return list.toOwnedSlice(allocator);
+    return resp.body;
 }
 
 // ═══════════════════════════════════════════════════════════════════════════════