fix: dark-mode input surfaces and stall-based install timeouts

[yujiezhang-ops]

Two independent bug fixes, one commit each.

Dark-mode text inputs (e5fa71a)

The API Key field stayed white in dark mode. Two causes, both needed fixing:

.secure-field and .search-field draw their own border, focus ring and background and hold the <input> as a bare text surface. The rule that themes every other field, .field-stack > input, is a child selector, so the wrapper in between stops it applying. Nothing else coloured these inputs, so the UA sheet's white default showed inside a dark box.

color-scheme also stayed at the :root default of light dark, following the desktop rather than the forced palette. It controls the parts of a control CSS cannot reach — a password field's masking dots, the caret, the autofill background — so forcing dark on a light desktop gave a dark field with a light caret.

Stall-based install timeouts (5f84f1a)

Installs and runtime downloads failed on slow links. The limits were elapsed time (180s per command, 10 min per download), which punishes a slow transfer for being slow while doing nothing about one that has actually died.

Both are now stall-based: no output from a command, or no bytes on a transfer, for the stall window ends it; anything still making progress runs as long as it needs. Old deadlines remain as one-hour backstops. http.Client.Timeout is replaced by dial and response-header timeouts, since that field bounds body reads too and was itself killing healthy transfers.

Stalls surface as ErrStalled, distinct from context.DeadlineExceeded and context.Canceled, so a dead network reads differently from the Task Center's stop button — and the captured stdout/stderr goes back with the error, since what the command said before going quiet is the only clue to where it stuck.

Two subtleties worth a reviewer's eye: liveness is recorded before boundedBuffer can discard, or a command past its 1 MB output cap would look stalled while healthy; and the watchdog polls a timestamp rather than arming a timer per read, which for a 50 MB download is hundreds of thousands of reads.

The frontend now sends timeout: 0 to mean "use the Go default" instead of repeating 180, which had been a second source of truth that disagreed silently once Go's default moved.

Testing

• go test ./... — all packages pass
• go test -race ./internal/{process,install,binding,desktopapp} — clean
• go vet ./... — clean
• pnpm run test — 30 files / 226 tests pass
• pnpm run build (includes tsc --noEmit) — pass

New coverage: frontend/src/styles/input-surface.test.ts guards both wrappers and the color-scheme pairing; the Go side adds stall, cancellation-vs-stall, slow-but-alive, output-flood, and output-preserved-on-stall cases.

Dark mode was verified against computed styles in all three theme states (forced dark, forced light, follow-system) rather than by screenshot, since colour is what's under test.

🤖 Generated with Claude Code