Function build_safe_response 

pub fn build_safe_response(
    status: u16,
    headers: impl IntoIterator<Item = (String, String)>,
    body: String,
    context: &str,
) -> Response<Full<Bytes>>

Build a hyper Response from parts that came from the LLM or from server startup params, without ever panicking.

Everything here is attacker- or model-influenced, so nothing is trusted:

• an out-of-range status (status < 100 || status > 599) is replaced by 500,
• header names/values hyper rejects (notably ones containing CR/LF, i.e. response-splitting attempts) are dropped individually,
• if the builder still fails for any reason, a bare 500 is returned.

The previous implementation ended in .body(..).unwrap(), which turned any of the above into a panic inside the connection task.