Add configurable HTTP timeouts to platform clients (#867)

[vishal-uttamchandani]

• All platform HTTP clients previously used http.DefaultClient (no timeout), making them vulnerable to hanging indefinitely on slow or unresponsive upstream services.
• Added a Timeout field to client.Config (default 60s, overridable via TIDEPOOL_HTTP_TIMEOUT env var) so the timeout is configurable per-service without code changes.
• Applied consistent 60s timeouts to platform/client.go, oauth/token/source.go, appvalidate/CoastalSecrets, appvalidate/PalmTreeSecrets, and the tapi CLI tool.
• Added unit tests covering both the structural (timeout is wired into the http.Client) and behavioral (requests against a slow server actually time out) properties of each client.
• go test ./client/... ./platform/... ./appvalidate/... ./oauth/token/... — all pass
• TIDEPOOL_HTTP_TIMEOUT env var overrides the default at runtime (e.g. TIDEPOOL_HTTP_TIMEOUT=30s)

Implements #867