[codex] add request timeouts

[andrewkoltsov]

Summary

• add a shared fetch timeout wrapper for portal and Synergia requests
• expose requestTimeoutMs on the SDK client/session option surfaces and read LIBRUS_TIMEOUT_MS in LibrusSession.fromEnv()
• add stable NETWORK_TIMEOUT SDK and CLI behavior, document the new timeout surface in README/CHANGELOG, and tighten timeout-path secret-safety coverage

Why

Hanging network requests could leave portal login or child-scoped API calls pending indefinitely. This change hardens the runtime behavior so those requests fail predictably with a secret-safe, machine-stable error code instead.

Impact

• SDK consumers can now configure request timeouts through PortalClientOptions, SynergiaApiClientOptions, and LibrusSessionOptions
• LibrusSession.fromEnv() now honors LIBRUS_TIMEOUT_MS
• portal and Synergia fetches default to a 30 second timeout and fail with NETWORK_TIMEOUT including { endpoint, timeoutMs }
• CLI text and JSON error output preserve the same secret-safe timeout semantics
• README and changelog now document the timeout contract required for this user-facing change

Root Cause

The SDK previously delegated directly to fetch without a timeout policy, so a connection that never responded would remain pending until the caller or process intervened.

Validation

• npm run validate