v0.9.0: per-request timeout override via X-Proxq-Timeout header

- Send X-Proxq-Timeout: 2m30s to override upstream config timeout
- Invalid value → 400 Bad Request
- Omit header → upstream config timeout applies as before