feat(sessions): two-phase streaming timeout for LLM calls

[Aaronontheweb]

Summary

Closes #447.

Replaces the single hard wall-clock TurnLlmTimeout (3 min default) with a
two-phase timeout that distinguishes "waiting for prefill" from "detecting a
dead stream":

• FirstTokenTimeout (default 10 min): generous ceiling for the prefill
  phase where the model processes large input contexts before generating output
• StreamIdleTimeout (default 2 min): tight timeout that resets on every
  streaming delta, catching dead connections quickly once tokens start flowing

Also reverts the retry-with-backoff mechanism (TimeoutRetryHandler) which was
solving the wrong problem — retrying against a slow-but-alive provider just
wastes inference time and API cost.

Industry precedent: Anthropic SDK
#867,
Claude Code #6781,
#18028.

Changes

• Watchdog starts with FirstTokenTimeout, switches to StreamIdleTimeout
  on first LlmResponseDeltaReceived
• _firstDeltaReceived flag tracks which phase we're in
• Error messages distinguish "provider did not respond" from "stream stopped
  unexpectedly"
• ProcessingWatchdogExpired handler uses ExtractLlmErrorMessage for
  contextual error messages instead of hardcoded string
• Backward compat: existing TurnLlmTimeoutSeconds config respected as
  fallback when new properties not set
• Removed: TimeoutRetryHandler, RetryLlmCallAfterBackoff,
  HandleTimeoutRetryOrFail, retry config properties

Test plan

• dotnet build — clean (0 warnings, 0 errors)
• dotnet test — 1289 tests pass (0 failures)
• dotnet slopwatch analyze — no new violations
• LlmSessionTwoPhaseTimeoutTests — 3 new integration tests:
  • First_token_timeout_fires_when_no_deltas_arrive
  • Stream_idle_timeout_fires_when_stream_stalls_after_deltas
  • Successful_stream_completes_without_timeout
• Existing watchdog and error correlation tests updated and passing
• Self-review caught and fixed inverted backward-compat fallback logic