Add reliable timeout for native HTTP input

[vmvarela]

Description

Add a reliable whole-request timeout for native HTTP input introduced by #171.

The pinned Zig toolchain (0.16.0-dev.3028+a85495ca2) exposes timeout fields in parts of std.http.Client, but does not apply them. The current single-threaded std.Io.Threaded setup also cannot preempt blocked DNS, connect, TLS, or response reads safely.

Acceptance Criteria

• Add --timeout <seconds> with a 30-second default
• Bound DNS, connection, TLS handshake, response headers, and body reads
• Return a clear timeout error without hanging or panicking
• Add deterministic local-server integration tests
• Document timeout behavior and limitations

Notes

Follow-up to #171. Implement after a Zig toolchain upgrade or a deliberate cancellable/threaded I/O redesign makes the behavior reliable.