Two related defects in `terrain serve`, both flagged by the launch-
readiness review and verified in the codebase:

1. **Request context not wired.** The HTTP handlers ignored
   r.Context() and called engine.RunPipeline (which wraps
   context.Background()), so a client disconnect during a long
   analysis left the analysis running in the background with no
   handler waiting on it.

2. **Mutex-blocking analysis cache.** getResult held Server.mu via
   defer-Unlock for the full analysis duration. One slow analysis
   serialized every other request needing a pipeline result behind a
   single goroutine, regardless of whether the cache was warm enough
   for them.

Both ship together because the right fix to (2) replaces the cache
mutex with an RWMutex + singleflight, which also gives us a clean
seam for (1):

  * Fast path: RWMutex.RLock so warm-cache hits don't contend.
  * Slow path: singleflight.Group.DoChan dedups concurrent in-flight
    analyses (one analysis per cache window, even with N waiters).
  * Per-caller cancellation: each handler threads r.Context() through
    getResult; the select on (ch | ctx.Done()) returns ctx.Err()
    immediately on disconnect. The shared analysis runs with
    context.Background() so a single caller's disconnect doesn't kill
    work other waiters depend on.

Tradeoff documented inline: a single-waiter request whose context is
canceled won't (yet) cancel the underlying analysis. Reference-
counting waiters is on the 0.3 list.

Tests added:
  * TestGetResult_CacheHit — fast path returns cached pointer
  * TestGetResult_RespectsCanceledContext — pre-canceled context
    returns context.Canceled within 2s rather than blocking on
    analysis (pre-fix this hung until pipeline completion)
  * TestGetResult_ConcurrentCallsShareCache — 50 concurrent callers
    on a warm cache observe the same report pointer

Dep: golang.org/x/sync v0.10.0 (singleflight). Pinned to v0.10.0
because v0.20.0 bumps the go directive to 1.25; v0.10.0 is
compatible with the existing go 1.23.

Server-package doc-comment refreshed to describe the new
concurrency model and remove the now-fixed "known issues" block
that was added in PR #131.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>