[pa-devbot]

Summary

Follow-up to the TCP security audit of Common/Cpp/Sockets/: a client that connects but never reads fills the kernel send buffer, and the send() loops on every backend spin on EAGAIN forever, pinning the calling thread. On the Qt backend the undrained write also pins the server's event thread, which makes close_connection()/close() on that server block indefinitely as well.

This PR adds an optional deadline to the server socket:

virtual size_t send(const void* data, size_t bytes,
    std::chrono::milliseconds timeout = std::chrono::milliseconds::max()) = 0;

• Default is ms::max() — the previous unbounded behavior; the server socket has no app callers yet, so no caller changes are needed.
• On expiry the loop stops writing and returns the number of bytes actually written, leaving the connection untouched (the caller can retry, close, or keep the connection for reads).
• No backend ever waits longer than before.

Per backend

• POSIX / WinSocket: deadline check at the top of the existing send loop.
• Qt (the non-trivial part): the deadline is carried into the queued write call, so the event-thread write loop self-terminates at the deadline — this is what un-pins the event thread so close_connection() (which runs on it) can proceed. The caller-side CV wait becomes timeout + 1 s (queueing margin); the previous flat 5 s safety wait is kept for the infinite default, covering close()/close_connection() destroying the server before the queued call runs.
• The interface docs live once on AbstractServerSocket::send(); the default-argument re-declaration stays on each override (C++ default arguments are not inherited, and callers use the concrete type).

Known Qt backend caveat (pre-existing, not changed by this PR)

QTcpSocket::write() accepts the whole payload into Qt's userspace buffer and reports it as written, so kernel backpressure never reaches the Qt write loop. A stalled peer therefore shows up as "send completed" (data parked in RAM), not as a partial count. The bounded-caller guarantee still holds: send() always returns within its deadline.

Test

Test_Sockets_ServerSendTimeout (per backend): loopback pair where the client stalls reading; the server sends 256 MB with a 100 ms deadline; close_connection() must finish afterwards.

• Large-buffer OSes: Windows CI buffered the entire 256 MB payload in its autotuned socket buffers against the stalled peer, so a send that "completes" is retried: those kernel buffers are now full, so a follow-up send cannot complete and must stop at the deadline (up to 4 times, i.e. unless the OS buffers over 1 GiB).
• Starvation tolerance: the peer's stall lasts 12 s (longer than the 10 s send threshold) and is interruptible, so shutting the peer down does not wait for it; see the second commit for the full mechanism.

Also in this PR (second commit)

The loopback tests are now tolerant of thread starvation on loaded CI machines — this fixes the recurring macOS flake in the client test from #1825 (close() did not finish after the timed-out send (6025 ms)), which this branch carries:

• timing_unreliable(): a 32 MB copy + 100 ms sleep that should take well under a second on a healthy core; more than 2 s means the calling thread is being starved and the test's timing assertions cannot be trusted.
• Every socket test skips instead of failing when the machine is starved (up front, and on connect/listen failures); the deadline tests additionally skip at their threshold crossings, and the close check first round-trips a zero-length send through the socket's event thread (on Qt, the thread close() waits on), so a slow close with a slow control is the machine's fault, not a bug.
• The close threshold is 10 s instead of 5 s, and all connect/listen/data waits share a 30 s budget instead of 5 s. The pre-fix failure mode is an infinite hang, so the thresholds only have to prove boundedness while tolerating a loaded runner.

Verification

• pa-build clean; full pa-test command-line suite: 20,329 passed, 0 failed, 3 skipped (including all 4 deadline tests).
• WinSocket backend compiles via CI (Windows).

Notes for reviewers

• Sister PR Sockets: add an optional deadline to ClientSocket::send() #1825 (client) is merged; this branch is rebased onto it (squashed to the 2 commits above).
• Out of scope (separate audit findings, separate PRs): the connect-phase lock held across the connect loop, listener-exception isolation, and the cross-backend send() semantic differences (Win partial-write return vs POSIX/Qt loop-to-completion; the Qt userspace buffering above).