Fix incorrect default values in docs and example config for startup/tool timeouts and domain (#3652)

Three documentation discrepancies between `config_core.go` constants and
user-facing docs: `startupTimeout`/`toolTimeout` defaults were
documented as 2× their actual values, and `domain` was documented as
defaulting to `"localhost"` when it has no code-level default.

## Changes

- **`docs/CONFIGURATION.md`** — Gateway config table: `startupTimeout`
`60`→`30`, `toolTimeout` `120`→`60`, `domain` default
`localhost`→`(unset)`
- **`config.example.toml`** — Inline comments corrected: `(default:
60)`→`(default: 30)` and `(default: 120)`→`(default: 60)`; explicit
override values (`60`/`120`) intentionally kept as examples of
non-default configuration

## Authoritative source

```go
// internal/config/config_core.go
DefaultStartupTimeout = 30   // seconds (per spec §4.1.3)
DefaultToolTimeout    = 60   // seconds (per spec §4.1.3)
```

Author: lpcox

config.example.toml

@@ -22,11 +22,11 @@ api_key = ""
 # Used for CORS and other domain-specific features
 domain = ""
 
-# Timeout for backend MCP server startup in seconds (default: 60)
+# Timeout for backend MCP server startup in seconds (default: 30)
 # How long to wait for an MCP server to start before timing out
 startup_timeout = 60
 
-# Timeout for tool execution in seconds (default: 120)
+# Timeout for tool execution in seconds (default: 60)
 # How long to wait for a tool call to complete before timing out
 tool_timeout = 120
 

docs/CONFIGURATION.md

@@ -364,9 +364,9 @@ The `customSchemas` top-level field allows you to define custom server types bey
 |-------|-------------|---------|
 | `port` | Validated and stored for metadata purposes only. The actual listen address is always set by the `--listen` CLI flag (default `127.0.0.1:3000`). | `3000` (informational only) |
 | `apiKey` | API key for authentication | (disabled) |
-| `domain` | Gateway domain (`"localhost"`, `"host.docker.internal"`, or `"${VAR}"`) | `localhost` |
-| `startupTimeout` | Seconds to wait for backend startup | `60` |
-| `toolTimeout` | Seconds to wait for tool execution | `120` |
+| `domain` | Gateway domain (`"localhost"`, `"host.docker.internal"`, or `"${VAR}"`) | (unset) |
+| `startupTimeout` | Seconds to wait for backend startup | `30` |
+| `toolTimeout` | Seconds to wait for tool execution | `60` |
 | `payloadDir` | Directory for large payload files | `/tmp/jq-payloads` |
 | `trustedBots` (JSON) / `trusted_bots` (TOML) | Optional list of additional bot usernames to trust with "approved" integrity level. Additive to the built-in trusted bot list. When specified, must be a non-empty array with non-empty string entries (spec §4.1.3.4); omit the field entirely if not needed. Example: `["my-bot[bot]", "org-automation"]` | (disabled) |
 | `keepaliveInterval` (JSON) / `keepalive_interval` (TOML) | Interval (seconds) between keepalive pings sent to HTTP backends. Prevents remote servers from expiring idle sessions. Set to `-1` to disable keepalive pings entirely. | `1500` (25 min) |