fix(fleetnode): drop http.Client.Timeout on authenticated gateway client

[ankitgoswami]

Summary

The authenticated gateway client introduced in #227 reuses `newGatewayHTTPClient()` whose `http.Client.Timeout: 30s` covers the entire request lifecycle (including reading the response body). For long-lived streaming RPCs that's the streamed message channel itself — so any `ControlStream` / `UploadTelemetry` / `UploadEvents` open via this client would be forcibly torn down at the 30-second mark.

Latent today (`fleetnode run` only does the unary `UploadHeartbeat`, which finishes well under 30s), but the next PR that wires up any streaming RPC would have discovered it immediately. Fixing the foundation here keeps that PR focused on its actual feature.

Changes

• New `newStreamingGatewayHTTPClient()` in `authclient.go`: no top-level `Timeout`; keeps the no-redirect `CheckRedirect`. Used by `NewAuthenticatedGatewayClient`.
• Unchanged: `newGatewayHTTPClient()` (used by bootstrap's unary `Register` / `BeginAuthHandshake` / `CompleteAuthHandshake`). Those calls are bounded and the 30s circuit-breaker is correct for the interactive enroll/refresh flows.
• Daemon: `sendHeartbeat` now wraps each call in `context.WithTimeout(heartbeatRequestTimeout)`. Preserves the "single hung heartbeat doesn't pin the daemon" guarantee that the client-level `Timeout` used to provide, but applies it only to unary calls; future streaming methods will pass the loop ctx without an artificial deadline.
• Regression test pins that `newStreamingGatewayHTTPClient().Timeout == 0` and that `CheckRedirect` still refuses redirects.

Test plan

• `PATH=./bin:$PATH go build ./server/...`
• `PATH=./bin:$PATH go vet ./server/...`
• `cd server && PATH=../bin:$PATH golangci-lint run -c .golangci.yaml ./...` — 0 issues
• `DB_PASSWORD=fleet PATH=./bin:$PATH go test ./server/... -count=1` — 68 packages OK
• CI runs the full suite

🤖 Generated with Claude Code

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (dbb1a4f9534c8cb88a74d1a11db5908f2bca3dd1...b0d5e1a58c5e6cd979e0fdee631d67d781e4fe92, exact PR three-dot diff)
• Model: gpt-5.5

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: NONE

Findings

No security, correctness, or reliability findings in the reviewed diff.

Notes

The PR scope is limited to replacing the authenticated fleet-node gateway client’s top-level http.Client.Timeout with a streaming-safe client, while adding a per-heartbeat context.WithTimeout around UploadHeartbeat. I verified the authenticated client is only used by the fleetnode daemon heartbeat path in this diff, and enrollment/refresh still use the existing bounded NewGatewayClient.

I did not run tests due to the read-only sandbox, but the added test coverage matches the intended behavior: no top-level timeout on the streaming-capable authenticated client, redirect rejection preserved, and heartbeat calls bounded by context.

---

_{Generated by Codex Security Review |
Triggered by: @ankitgoswami |
Review workflow run}

[Copilot]

Pull request overview

This PR fixes an important foundation issue for the fleetnode authenticated gateway client: it removes the http.Client.Timeout that would otherwise hard-cut long-lived streaming RPCs after 30 seconds, while preserving redirect hardening and maintaining unary-call safety via per-call context timeouts.

Changes:

• Switch NewAuthenticatedGatewayClient to use a new HTTP client constructor intended for streaming (no top-level http.Client.Timeout, still rejects redirects).
• Add a regression test to pin Timeout == 0 and redirect rejection behavior for the streaming client.
• Add a per-heartbeat context.WithTimeout so a hung unary heartbeat can’t block the daemon loop indefinitely.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
server/internal/fleetnodebootstrap/authclient.go	Introduces newStreamingGatewayHTTPClient() and uses it for the authenticated gateway client to avoid breaking streaming RPCs.
server/internal/fleetnodebootstrap/authclient_test.go	Adds a regression test ensuring the streaming HTTP client has no top-level timeout and still rejects redirects.
server/cmd/fleetnode/run.go	Wraps each UploadHeartbeat call with a per-call context timeout to preserve “no hung heartbeat pins daemon” behavior.

[ankitgoswami]

Closing in favor of bundling the streaming-friendly HTTP client into the first PR that actually uses streaming. Commit b0d5e1a stays on the ankitg/fleetnode-streaming-timeout branch for cherry-pick when needed.