Implement layered timeout enforcement

engine.go

@@ -47,7 +47,11 @@ type Config struct {
 	PromptDir  string
 	ProfileDir string
 	SchemaDir  string
-	Timeout    time.Duration
+	// Timeout is the transport-wide safety cap for the built-in LLM client
+	// when HTTPClient is absent or has a non-positive timeout.
+	Timeout time.Duration
+	// HTTPClient is cloned for the built-in LLM client. Its positive Timeout
+	// takes precedence over Config.Timeout as the transport-wide safety cap.
 	HTTPClient *http.Client
 }