Stability and safety improvements

[karust]

Summary

• Add a derived per-request timeout for non-/mega/*, non-/extract routes so hung engine requests return 504 request_timeout instead of running open-ended.
• Harden /extract URL handling with public-network validation, HTTP/HTTPS-only targets, redirect re-validation, raw dial IP pinning, rendered-mode preflight, and extract.allow_private_networks as an explicit opt-out.
• Stabilize protection paths by caching rate limiters, avoiding circuit-breaker penalties for cancellations/deadlines, and removing request-path panics from browser resource blocking / CLI block_resources parsing.
• Add focused tests for request deadlines, extraction SSRF blocking, limiter caching, cancellation handling, and circuit-breaker behavior.
• Fix integration tests timeout issue

Why

• Prevent slow or hung search requests from exceeding the configured retry budget.
• Reduce SSRF/private-network risk in extraction without breaking public bare-host extraction.
• Keep rate limiting effective across repeated calls and avoid marking healthy engines unhealthy because a client/request deadline fired.
• Make safety behavior deterministic and covered by unit tests.

Testing

• make test
• make lint
• make test-integration (only for browser, proxy, captcha, or live-engine changes)

Checklist

• I linked the related issue or explained why there is none.
• I updated docs or examples for changed user-facing behavior.
• I kept unit tests deterministic and free of browser/network dependencies.
• I removed secrets, proxy credentials, and private logs from examples.