tests: a failed server check fails the test instead of hanging it, and the tls idle tests leave the handshake room

src/server/doh_server.zig

@@ -1216,9 +1216,11 @@ fn twoPostsOneConnection(io: std.Io, remote: net.IpAddress) anyerror!void {
     try conn.end();
 }
 
-/// Long enough for a loopback round trip, short enough that the `bounded`
-/// budget still fails a server that never reclaims the connection.
-const short_idle: std.Io.Clock.Duration = .{ .raw = .fromMilliseconds(300), .clock = .awake };
+/// The TLS handshake runs inside this budget too: a Debug-build handshake takes
+/// about 100 ms on an idle machine, and a loaded CI runner failed it at
+/// 300 ms. The `bounded` budget still fails a server that never reclaims the
+/// connection.
+const short_idle: std.Io.Clock.Duration = .{ .raw = .fromSeconds(2), .clock = .awake };
 
 /// One request, then silence on a connection the client keeps open. The server
 /// owes no answer, so the only thing that can end the read is the idle budget.