Adds a first-class handlerTimeout option, configurable per-server and per-route, backed by an AbortSignal exposed as request.signal. Unlike the existing socket-level timeouts (connectionTimeout, requestTimeout), this is an application-level timeout that works correctly with HTTP keep-alive and can be scoped to individual routes, and used together with flows that support AbortSignal (fetch, DBs etc).

Highlights

• Zero overhead when disabled: default is 0 (no timeout). No AbortController, setTimeout, or event listeners are
  created, only a single branch check per request
• Per-route override: works like bodyLimit — routes inherit the server default and can override with a different
  value;
• Cooperative cancellation: timeout sends a 503 response and aborts request.signal, but does not kill the handler.
  Handlers use request.signal to propagate cancellation to downstream I/O;
• Unified signal: request.signal aborts on either timeout or client disconnect. signal.reason distinguishes the two
  (FST_ERR_HANDLER_TIMEOUT vs generic AbortError);
• Full resource cleanup: timer and close listener are cleaned up in every exit path — normal response, error,
  reply.hijack(), timeout, and client disconnect;
• Customizable error response: the timeout error flows through the route's errorHandler, allowing per-route
  status/body customization;
• Fail-fast on misconfiguration: accessing request.signal without handlerTimeout configured throws
  FST_ERR_MISSING_HANDLER_TIMEOUT.

Checklist

• run npm run test && npm run benchmark --if-present
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct