snapshot store: bound the transfer on both ends

The receiver blocked in read until a peer sent a header, and a stalled
btrfs receive was never reaped, so a silent or stuck connection held a
root service instance indefinitely. The receiver now gives the header 30 s
and the unit has RuntimeMaxSec=6h.

The sender had no deadline on the TCP connect or the header write, so an
unreachable mesh address held the admin-socket handler until the kernel
gave up. Both now time out after 15 s and report it like any other
failure. The stream body stays unbounded on the sender: the receiver's
RuntimeMaxSec already caps it, and btrfs send writes it outside this
process.

docs/networking/snapshot-store.md

@@ -108,6 +108,9 @@ the case the store exists to serve.
 A `btrfs send` stream carries no notion of _which agent_ it belongs to,
 and the subvolume name inside it's chosen by the sender. The
 protocol is one `agent <name>` header line, then the raw stream.
+The receiver waits 30 s for the header, and systemd stops a transfer
+that runs past 6 h in total. The sender gives connect and header write 15 s
+each; it puts no limit on the stream itself.
 
 The rule that matters: