fix(cli): apply configured API request timeout - #1621

Cursor (@cursor) review

PR Summary

Medium Risk
Changes core outbound HTTPS request behavior for all direct API paths; mis-tuned timeouts could break long-running scans, though invalid env values are ignored and integration tests cover key edge cases.

Overview
Direct Socket API calls now honor SOCKET_CLI_API_TIMEOUT when it is a finite positive value. apiFetch accepts an optional per-request timeout, applies it via node:https request options, surfaces ETIMEDOUT on header and stalled-body failures, and carries the same timeout through redirects (including non-preserving 302-style hops).

queryApi, queryApiSafeTextWithStatus, and sendApiRequest automatically attach the resolved configured timeout; raw apiFetch without that helper still has no default unless a caller passes timeout explicitly. Timeout failures in text/JSON reads now return clearer causes instead of generic read/parse errors.

Adds a unit test for resolveConfiguredSocketApiTimeout and a loopback HTTPS integration suite that generates a short-lived localhost cert and exercises GET/POST, idle bodies, unset config, explicit overrides, and 302/307 redirect behavior.

^{Reviewed by Cursor Bugbot for commit 4488885. Configure here.}

Cursor (@cursor) review