One extra table-driven case for the exercise: READ_HEADER_TIMEOUT=-1s. It parses successfully and the current validation accepts it, but net/http treats a negative ReadHeaderTimeout as no header timeout.

I would either reject that value at startup or make disabling the timeout an explicit documented option. Zero deserves its own case too: it falls back to ReadTimeout rather than disabling the header timeout outright. That distinction is easy to miss when every duration shares the same parser. Reference: https://pkg.go.dev/net/http#Server