[MudassarTariq]

Hide API keys in request errors and redirect headers. Add max_response_mb with a 256 MB default, reject zero and negative timeouts, and update golang.org/x/net to 0.62.0.

Existing tables, columns and successful response data stay the same. HTTP error status codes, retries and cancellation are preserved. A lookup that exceeds the size limit follows the existing failed-lookup behavior: log the error, skip that lookup and continue with the remaining inputs.

Validation:

• Race-enabled tests on Go 1.26.10 and 1.27.3, with both HTTP/2 implementations.
• Module verification, go vet, Linux builds and vulnerability scans passed.
• Tests cover all five tables, key redaction in logs and redirects, compressed and chunked responses, size boundaries, invalid settings, HTTP error bodies and timeout handling.
• Large ASN results with 50,000 routes passed. A local API simulation returned all 50,000 bulk records in order under the default limit.
• The README and configuration guide use the same tested settings.