Add a configurable secure-listener queue timeout so queued admission cannot wait indefinitely when the worker pool is exhausted while the event loop continues serving connection-level traffic. Queue timeouts use the existing 503 Retry-After refusal path, account separately from streaming refusals, and keep the fast admission path inert when capacity is immediately available. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>