Follow-up to #827 (which was merged before all review feedback could be folded in).
Addresses comments from @oskarszoon and @ordishs.

Changes

• Subtree page (JSON) — readSubtreePageFromReader now returns an empty page when the requested offset is past the end of the subtree (matching readSubtreeNodesPageFromReader) instead of silently wrapping back to offset 0. The wrap was confusing for paginated clients. (review item [FEAT] Peer service should sanity check asset_httpPublicAddress #2)
• settings.conf — Documented the actual non-zero defaults for the asset subtree concurrency keys (asset_concurrency_get_subtree_data=2, ..._data_reader=4, ..._transactions=2, asset_subtreeDataStreamingConcurrency=2). The previous block claimed 0 = unlimited defaults, which silently became 2 / 4 / 2 / 2 in Stream asset subtree responses to reduce memory use #827. (review item Why can mining nodes run without downloading the entire blockchain? #3)
• Streaming benchmark + alloc regression test — Added an un-gated BenchmarkSubtreeNodeHashesReader and a regression test (TestSubtreeNodeHashesReaderAllocsBound) that runs it via testing.Benchmark and asserts AllocsPerOp <= 16. The original benchmarks were behind RUN_SUBTREE_BENCHMARK=true and never ran in CI, so the streaming memory savings claim was not machine-verified. (review item Is it possible to develop a mining pool for the testnet using Teranode? #4)
• scheduleSubtreeChunkFetches error masking — Prefer waitErr (real worker error) over readErr (which is the context.Canceled we observe when the errgroup cancels gCtx). Falls back to readErr when waitErr is nil or itself a cancellation, so genuine read errors are still surfaced. (review item fix(model): correct BlockHeaderMeta serialization and add ProcessedAt support #6)
• GetSubtree handler — Collapsed the trailing dead switch + unreachable return nil into a direct if/else; mode is already validated above. (review item Is it possible to develop a mining pool for the testnet using Teranode? #4)
• Deployment docs — assetServer.md gains a section explaining that the gzip-skipped /subtree* endpoints require upstream rate-limiting / ACL in a reverse proxy (nginx limit_req_zone / limit_conn_zone or equivalent). The asset service does not yet do per-IP rate limiting; that is a planned defense-in-depth follow-up. (review item ops note)
• ConflictingNodes paginated-response semantics (documented here) — ConflictingNodes is now only populated when the page covers the whole subtree (offset==0 && pageSize==totalNodes). Partial pages return an empty ConflictingNodes array. This semantic was introduced in 827's b08a88e3 to avoid scanning all 1M nodes when paginating a large subtree; calling it out explicitly so any downstream consumer can adapt. (review item Why can mining nodes run without downloading the entire blockchain? #3)
• Tests — Targeted unit-test coverage for the new subtree_stream.go paths (negative args, offset past end, zero limit, page truncation, empty subtree, truncated header / conflict count, zero-length Read, context cancel, source.Close on header read failure), plus micro-tests for drainChunkResults and sendChunkResult. Boosts subtree_stream.go function coverage to ~75–82% and clears the SonarQube new-code-coverage gap for these files. (ordishs review item 1, 4)

Items not addressed here

• FeeHash JSON value — Confirmed not a regression; old behaviour also emitted zero-value FeeHash in /subtree/:hash/json. No code change needed. (review item #1)
• CodeQL findings at subtree_stream.go:118 and :178 — False positives; pageSize is provably bounded to ≤ 100 by both the HTTP-layer clamp (helpers.go:107-109) and the repository-layer defense-in-depth clamps (subtree_stream.go:86-88, 142-144). Max allocation ~4.8 KB per request. Suggest dismissing in the Security tab with that rationale rather than adding dead defensive code.
• claude[bot] finding at http.go:435 — Already refuted in the original PR review (parts[i+1:] cannot panic; Go allows slicing to len, and the len(tail)==1/2 guards prevent tail[1] OOB).

Test plan

• go test -race ./services/asset/... passes locally
• go vet ./services/asset/... clean
• New TestSubtreeNodeHashesReaderAllocsBound passes (locks in the streaming memory claim)
• make test — all asset-related packages pass; remaining failures are unrelated testcontainer (Docker daemon) issues in util/kafka and util/usql
• CI green (full pipeline)