fix(web): bound browser request duration

[seekskyworld]

Problem

Adds the request-timeout slice of #363. A stalled /api/prompt fetch could leave the composer admission state pending indefinitely and make later input appear unresponsive.

Value

The browser receives a bounded failure instead of waiting forever when the Web host or transport is unavailable.

Approach

Apply a 30-second AbortController deadline to the shared api() helper and always clear the timer, including failed requests. Callers retain their existing error handling.

Validation

• git diff --check

Impact

• User-visible behavior: stalled requests now fail visibly after a bounded period.
• Model-visible context/tools: none.
• Runtime/lifecycle: browser transport only.
• Persisted config/data: none.
• Compatibility/risk: additive timeout; callers may display the browser abort error.

[tt-a1i]

需要改：30s abort 挂在所有 api() 上

web/ui/app.js 的共享 api() 给每一次 fetch 都加了 30s AbortController。长 prompt 会在浏览器被掐掉，host 上的 turn 还在跑，UI 和运行时会拆开。

准入超时是对的，全局超时不是。请看 #370：默认超时可以留着，但 /api/prompt 的 admission 才应该用短超时；进行中的 turn 不要被浏览器单方面 abort。

建议关掉本 PR，或把超时从共享 api() 拿掉，改走 #370 的准入缝。