A test pins Server-Timing: a phase name never carries text from the request, and the header stays one valid line #6910

src/core/route_timing.ts writes the Server-Timing header every page carries (timePhase, timePhaseAsync, noteStart, nameFrame, namesFrame, noteDbTime, takeDbTime, noteSessionTime, takeSessionTime). None is named in a test.

Done:

• [ ] test/route-timing.test.ts: two phases timed on one request appear in the header in order, each with dur. A throw inside timePhase still records the phase and rethrows.
• [ ] A phase or frame name with a comma, semicolon, quote, CR or LF can't break the header. Either it is refused, or it is reduced to a token. Fix route_timing.ts if neither is true today.
• [ ] takeDbTime and takeSessionTime give the time once, then nothing, and never leak one request's time into another's.

This is a new test file only. Change code only where the test finds a hole, and say so in the pull. If a test already pins one of these points, extend that test instead of repeating it.

Files: test/route-timing.test.ts

Before pushing: bun x tsc --noEmit and the test you add. Tests pass now in and never read the wall clock.