#36198 http: Add missing LIFETIMEBOUND annotations

• Catch dangling references to HTTP server state at compile time
• Warn developers when return values or views are bound to temporary objects

This PR annotates six accessor methods in src/httpserver.h with the LIFETIMEBOUND attribute. This enables Clang's lifetime analysis to warn at compile time when return values or views are bound to temporary HTTP server objects.

Problem: Methods returning references or string views into internal HTTP server state can lead to dangling references if invoked on temporaries, which standard compiler warnings might not catch without explicit lifetime annotations.

P4 · cleanup

• P4 because it adds static analysis annotations without fixing an active defect
• Reduces future footguns by flagging use-after-free hazards on temporaries during compilation

P4 because this is a minor static-analysis annotation pass that does not fix an existing bug. As the author notes in the commit message, it 'Decreases footguns without any hit to runtime performance' by enabling Clang warnings on temporary use-after-free hazards, but there is no active defect being resolved.

Membership: Touches src/httpserver.h, which implements the internal HTTP server infrastructure for RPC and REST.

Factors: security/stability 1, bug 0, performance 0, user value 0, leverage 0

• Ready to review
• Small patch with passing CI and no pending blockers

The patch is small, cleanly rebased, passes CI, and has no pending blockers.

Author status: active

• No review activity yet
• Awaiting initial feedback from maintainers

Crickets, no review activity yet.

No reviewers have commented or reviewed the PR yet.

Review verdicts (DrahtBot): 0

0 lines under test/bench/ci.

• src/httpserver.h +6/-6

Adds LIFETIMEBOUND attributes to six accessor methods in src/httpserver.h so that Clang can detect dangling views and references derived from temporary HTTP server objects. It addresses potential developer footguns during future HTTP server development rather than fixing an existing user-facing bug. The change is tiny (+6/-6) with no runtime behavior or performance impact. It is currently unreviewed.