refactor: extract shared HTTP timeouts

[mvanhorn]

What?

Centralizes the five HTTP-client timeouts that #989 called out. New internal/httpclient package owns named constants for each call site (PluginCallTimeout, RegistryFetchTimeout, RemoteImageTimeout, InstallTimeout, UpdateCheckTimeout) plus a thin New(timeout) / NewWithRedirectCap(timeout, max) factory pair. Each of the five sites listed in the issue now references the constant instead of inlining a magic duration.

Why?

Issue #989 lists plugin/http.go:13 (10s), plugins/embed.go:25/56 (10s × 2), view/html.go:300 (5s), cli/install.go:25 (30s), and main.go:67 (30s) as five different HTTP timeout literals across the codebase with no central knob. The issue offers two acceptable approaches: a configurable client factory, or "at minimum, extract timeout constants to a shared config." This PR takes the minimum-scope path so the call-site behavior is unchanged: same five timeouts, same intent (Lua plugin calls vs registry fetches vs inline image fetches vs CLI install vs update check), but no more grepping for time.Second to find them.

main.go's 5-redirect cap is the only non-trivial bit — it has a custom CheckRedirect that the other clients explicitly don't want. The NewWithRedirectCap helper preserves that policy without inlining the literal 5 or the redirect fmt.Errorf again.

Changes

• NEW internal/httpclient/httpclient.go — five named timeout constants with site-attributing doc comments; New(timeout) and NewWithRedirectCap(timeout, maxRedirects) factories.
• NEW internal/httpclient/httpclient_test.go — unit tests for the constants, the basic factory, the redirect-cap factory (both via direct CheckRedirect invocation and an end-to-end httptest.Server redirect-loop check).
• plugin/http.go — drops the local httpTimeout const and the time import; switches the package-level httpClient to httpclient.New(httpclient.PluginCallTimeout).
• plugins/embed.go — replaces both &http.Client{Timeout: 10 * time.Second} literals with httpclient.New(httpclient.RegistryFetchTimeout).
• view/html.go — replaces the inline 5-second image client with httpclient.New(httpclient.RemoteImageTimeout).
• cli/install.go — replaces the inline 30-second install client with httpclient.New(httpclient.InstallTimeout).
• main.go — replaces the package-level redirect-capped client literal with httpclient.NewWithRedirectCap(httpclient.UpdateCheckTimeout, 5). The 5 and the "stopped after N redirects" message now live exactly once, in the helper.

Testing

• go build ./... clean.
• go vet ./... clean (the existing clib OFF_MAX macro warning is pre-existing and present on upstream/master).
• go test ./internal/httpclient/... passes (3 tests including a live-server redirect-cap check).
• go test ./plugin/... ./plugins/... ./view/... ./cli/... passes — existing package tests untouched.

Closes #989

This contribution was developed with AI assistance (Codex).

[floatpanebot]

Hi @mvanhorn! Please fix the following issues with your PR:

• Title: Is too long (69 characters). The PR title must be strictly under 40 characters.
• Body: Missing the ## What? or ## Why? headings required by the PR template.

Formatting issues have been resolved. Thank you!

[mvanhorn]

Fixed: title shortened to 38 chars, body now uses ## What? / ## Why? headings as required.

[andrinoff]

lgtm

[andrinoff]

@LeaWhoCodes check this out.

[LeaWhoCodes]

lgtm

[mvanhorn]

Appreciate the merge @LeaWhoCodes. Centralizing the five HTTP timeouts behind named constants in internal/httpclient should make future tuning a lot less archaeology.

[mvanhorn]

Thanks @LeaWhoCodes. Centralizing those five HTTP timeouts into one internal/httpclient package was overdue, and now they are tunable from one place instead of scattered literals.

[mvanhorn]

Cheers @LeaWhoCodes, thanks for landing this. Centralizing the five HTTP timeouts in internal/httpclient with named constants per callsite should keep #989 from coming back.