fix: bound HTTP requests with a configurable timeout

[agammann]

HttpClient currently sends requests without a timeout. A server that accepts the connection but stalls its response can leave an awaited SDK request pending indefinitely, including requests made during a driver sweep.

Give every HTTP request a default total timeout of 30 seconds and add with_request_timeout(Duration) for callers that need another bound. Apply the timeout to all five request construction paths: info, create, get, list, and protected posts. The bound includes response body reads. WebSocket subscription behavior is unchanged.

The integration overview and builder documentation explain the timeout and the ambiguous outcome of a timed-out mutation: the server may already have processed it, so callers should inspect swap state before deciding whether to retry. No automatic mutation retry is added.

Validation: two local TCP fixture tests exercise five stalled-header cases and three stalled-body cases. Both tests failed at the outer watchdog before request timeouts were applied and pass with the fix. Existing successful HTTP and signed request tests also pass. The complete workspace suite passes with all features and locked dependencies: 83 core tests and 42 SDK tests. The client-only feature build, cargo fmt --all --check, and git diff --check pass.

Tested in Ubuntu on WSL using the repository's pinned nightly-2026-05-01 toolchain. Live swaps and WebAssembly builds were not exercised. Custom ServerClient and chain implementations still need to bound their own operations.