server: detect download stalls before the first byte


server: keep stall timeout out of download API