Add WebSocket TLS and timeout recipes to the Cookbook

T04 (mTLS) had grown a "WebSocketClient" subsection describing
wss:// client certificates, and c12/t02 were getting similar
WebSocketClient asides for timeouts and CA paths. The Cookbook's
own index already separates WebSocket into its own category
(W01-W04) from TLS/Security (T01-T05) and Client (C01-C19), so
burying WebSocketClient specifics inside those pages fought the
site's structure.

Move that content into two new recipes under the WebSocket
category instead:

- W05: wss:// TLS setup (set_ca_cert_path CA directory parity,
  PemMemory client certificate)
- W06: WebSocketClient's three timeouts, including the recently
  added chrono overloads

T04, T02, C12, and W01 now carry a single reference link to the
new pages instead of duplicated explanations, matching the site's
existing cross-link convention.

While rewriting T04's client-side section, noticed it documented
SSLClient's file-path constructor but not its PemMemory one, even
though the server-side section covered both forms for SSLServer.
Added the missing PemMemory example so both sides are symmetric.

docs-src/pages/en/cookbook/c12-timeouts.md

@@ -48,3 +48,5 @@ cli.set_read_timeout(10s);
 ```
 
 > **Warning:** The read timeout covers a single receive call — not the whole request. If data keeps trickling in during a large download, the request can take half an hour without ever hitting the timeout. To cap the total request time, use [C13. Set an overall timeout](../c13-max-timeout).
+
+> For WebSocket client timeouts, see [W06. Set Timeouts](../w06-websocket-timeouts).

docs-src/pages/en/cookbook/index.md

@@ -94,3 +94,5 @@ A collection of recipes that answer "How do I...?" questions. Each recipe is sel
 - [W02. Set a WebSocket heartbeat](w02-websocket-ping)
 - [W03. Handle connection close](w03-websocket-close)
 - [W04. Send and receive binary frames](w04-websocket-binary)
+- [W05. Configure TLS for wss:// connections](w05-websocket-tls)
+- [W06. Set timeouts](w06-websocket-timeouts)

docs-src/pages/en/cookbook/t02-cert-verification.md

@@ -51,3 +51,5 @@ On most Linux distributions, root certificates live in a single file like `/etc/
 > The same APIs work on the mbedTLS and wolfSSL backends. For choosing between backends, see [T01. Choosing between OpenSSL, mbedTLS, and wolfSSL](../t01-tls-backends).
 
 > For details on diagnosing failures, see [C18. Handle SSL errors](../c18-ssl-errors).
+
+> For TLS configuration on a WebSocket client (`wss://`), see [W05. Configure TLS for wss:// Connections](../w05-websocket-tls).

docs-src/pages/en/cookbook/t04-mtls.md

@@ -57,25 +57,21 @@ auto res = cli.Get("/");
 
 Note you're using `SSLClient` directly, not `Client`. If the private key has a password, pass it as the fifth argument.
 
-## WebSocket clients
-
-`ws::WebSocketClient` has the same `PemMemory` struct, so `wss://` connections can present a client certificate too.
+The client side has the same `PemMemory` struct too, letting you set the client certificate from PEM in memory.
 
 ```cpp
-httplib::ws::WebSocketClient::PemMemory pem{};
+httplib::SSLClient::PemMemory pem{};
 pem.cert_pem = client_cert.data();
 pem.cert_pem_len = client_cert.size();
 pem.key_pem = client_key.data();
 pem.key_pem_len = client_key.size();
 
-httplib::ws::WebSocketClient ws("wss://api.example.com/ws", pem);
+httplib::SSLClient cli("api.example.com", 443, pem);
 
-if (ws.connect()) {
-  ws.send("hello");
-}
+auto res = cli.Get("/");
 ```
 
-Passing `PemMemory` to a `ws://` (non-TLS) URL is silently ignored. There's no constructor that reads the cert files directly, so unlike `SSLClient` you always load the PEM into memory yourself before passing it in.
+> For mTLS with a WebSocket client (`wss://`), see [W05. Configure TLS for wss:// Connections](../w05-websocket-tls).
 
 ## Read client info from a handler
 

docs-src/pages/en/cookbook/w01-websocket-echo.md

@@ -85,4 +85,4 @@ svr.new_task_queue = [] {
 
 See [S21. Configure the thread pool](../s21-thread-pool).
 
-> **Note:** To run WebSocket over HTTPS, use `httplib::SSLServer` instead of `httplib::Server` — the same `WebSocket()` handler just works. On the client side, use a `wss://` URL.
+> **Note:** To run WebSocket over HTTPS, use `httplib::SSLServer` instead of `httplib::Server` — the same `WebSocket()` handler just works. On the client side, use a `wss://` URL. For CA and client certificate configuration, see [W05. Configure TLS for wss:// Connections](../w05-websocket-tls).

docs-src/pages/en/cookbook/w05-websocket-tls.md

@@ -0,0 +1,49 @@
+---
+title: "W05. Configure TLS for wss:// Connections"
+order: 55
+status: "draft"
+---
+
+Client-side TLS configuration for `wss://` (WebSocket over TLS) connections uses almost the same API as `SSLClient`. `ws::WebSocketClient` handles both `ws://` and `wss://` through the same class, so there's no separate class to switch to the way `SSLClient` requires.
+
+```cpp
+httplib::ws::WebSocketClient ws1("ws://localhost:8080/ws");   // plaintext
+httplib::ws::WebSocketClient ws2("wss://localhost:8443/ws");  // TLS
+```
+
+## Verifying the server certificate
+
+Use `set_ca_cert_path()` to point at your own CA certificate. The signature matches `SSLClient`: the first argument is the CA certificate file, the second is an optional CA directory.
+
+```cpp
+httplib::ws::WebSocketClient ws("wss://internal.example.com/ws");
+ws.set_ca_cert_path("/etc/ssl/certs/internal-ca.pem");
+
+if (ws.connect()) {
+  ws.send("hello");
+}
+```
+
+To disable certificate verification entirely, use `enable_server_certificate_verification(false)`. For details on that behavior, see [T02. Control SSL Certificate Verification](../t02-cert-verification).
+
+## Presenting a client certificate (mTLS)
+
+`ws::WebSocketClient` has a constructor overload that takes a `PemMemory` struct, letting `wss://` connections present a client certificate.
+
+```cpp
+httplib::ws::WebSocketClient::PemMemory pem{};
+pem.cert_pem = client_cert.data();
+pem.cert_pem_len = client_cert.size();
+pem.key_pem = client_key.data();
+pem.key_pem_len = client_key.size();
+
+httplib::ws::WebSocketClient ws("wss://api.example.com/ws", pem);
+
+if (ws.connect()) {
+  ws.send("hello");
+}
+```
+
+Passing `PemMemory` to a `ws://` (non-TLS) URL is silently ignored. There's no constructor that reads the cert files directly, so unlike `SSLClient` you always load the PEM into memory yourself before passing it in.
+
+For the full mTLS picture, including server-side setup and use cases, see [T04. Configure mTLS](../t04-mtls).

docs-src/pages/en/cookbook/w06-websocket-timeouts.md

@@ -0,0 +1,51 @@
+---
+title: "W06. Set Timeouts"
+order: 56
+status: "draft"
+---
+
+`ws::WebSocketClient` has the same three kinds of timeouts as `Client`, with the same meaning.
+
+| Kind | API | Default |
+| --- | --- | --- |
+| Connection | `set_connection_timeout` | 300s |
+| Read | `set_read_timeout` | 300s (`CPPHTTPLIB_WEBSOCKET_READ_TIMEOUT_SECOND`) |
+| Write | `set_write_timeout` | 5s |
+
+## Basic usage
+
+```cpp
+httplib::ws::WebSocketClient ws("ws://localhost:8080/ws");
+
+ws.set_connection_timeout(5, 0);  // 5 seconds
+ws.set_read_timeout(30, 0);       // 30 seconds
+ws.set_write_timeout(10, 0);      // 10 seconds
+
+if (ws.connect()) {
+  ws.send("hello");
+}
+```
+
+Set these before calling `connect()`.
+
+## Use `std::chrono`
+
+Just like `Client`, there's an overload that takes a `std::chrono` duration directly.
+
+```cpp
+using namespace std::chrono_literals;
+
+ws.set_connection_timeout(5s);
+ws.set_read_timeout(30s);
+ws.set_write_timeout(10s);
+```
+
+## Watch out for what the read timeout means
+
+`set_read_timeout()` applies to a single `read()` call. If no message arrives within that time, `read()` returns `ReadResult::Fail`. For connections where long idle periods are normal — waiting on notifications, for example — set a longer timeout, or reconnect from your application code when the read fails.
+
+> Unresponsive-peer detection via Ping/Pong is a separate mechanism. See [W02. Set a WebSocket Heartbeat](../w02-websocket-ping) for details.
+
+## How this differs from `Client`
+
+For `Client`'s timeout configuration, see [C12. Set Timeouts](../c12-timeouts). The behavior and API are nearly identical, but `WebSocketClient` has no equivalent to `set_max_timeout()` for capping the whole request — once connected, the connection stays open for as long as you keep calling `read()`.