feat(share): make the upload timeout settable, and raise the default

[bdelanghe]

One flat 30s covered every pathbase call. That is a fine ceiling for the small ones — auth, listing repos, deleting a graph — and the wrong one for an upload: a long agent session derives to several MB and the whole document goes up in a single request.

Hit for real against a loopback server, which is the case that should never time out. The message it produces is the tell:

request timed out after 30s — try again, or shrink the upload

You cannot shrink a conversation that already happened, so the advice has nowhere to go and the session is quietly dropped — in a tool whose whole job is not dropping sessions. The autoload sweep hit the same wall every ten minutes with the same result.

What changed

• Default 30s → 300s.
• --timeout <SECS> on share.
• PATH_HTTP_TIMEOUT_SECS for every command, including those with no flag of their own — which is what a launchd agent or a cron sweep can reach.

Set via the environment in run() rather than threaded as a Duration: the eight pathbase_client call sites are all small requests that never needed a knob, and giving each one a parameter to pass along would be noise at every site. It is applied before any client is constructed.

Scope

This raises a ceiling; it does not make an upload fast. A 4MB document taking more than 30s against loopback is its own question, answered separately in empathic/pathbase#414 — the API runs a debug build under the hot-reload service, and unoptimised serde_json is roughly an order of magnitude slower. That PR optimises dependencies; this one stops the client giving up while it works.

Verified

cargo check -p path-cli passes. Not exercised end-to-end against a real slow upload yet — the pathbase half has to land first for that to be a meaningful test.

Checklist

1. Independent PR — no bundled or speculative changes
   • Verified: the timeout constant, one flag, one env var
2. Changed codepaths verified — targeted unit and full integration tests
   • Verified: cargo check -p path-cli
3. Root cause identified — every failure traced to source
   • A single hardcoded Duration::from_secs(30) in pathbase_client, applied uniformly to calls with very different payload sizes
4. No duplication — refactoring preferred over copy/paste
   • One http_timeout() helper, one call site for it
5. No unrelated changes — housekeeping isolated to its own branch
   • N/A

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🔍 Preview deployed: https://2b8cbe32.toolpath.pages.dev