Composio follow-up: bound startup cancellation and forward Compose API key #152

Follow-up to #150 and the review findings, verified against 268772f8a395ad92f98ff33698f90713f1aca756.

1. Finish turns when Composio startup is cancelled or times out

src/server/dot-agent.ts awaits Composio session creation and tool discovery before creating the inner agent. These requests receive no abort signal. If either stalls, the 90-second turn timeout aborts the controller but does not complete the observable; the turn stays open until the request settles.

Reproduction: mock composioSession with a never-settling promise, enable global and per-Dot app permissions, subscribe to DotAgent.run, and advance fake timers by 91 seconds. The completion callback is not called. This regression probe failed against the reviewed head.

Acceptance criteria:

• Pass the turn abort signal through session creation/reuse and tool discovery using the SDK request options.
• Ensure a timeout emits the appropriate terminal error and completes the stream even while startup is pending.
• Ensure cancellation during startup prevents the inner agent from starting afterward.
• Add regression coverage for stalled startup, timeout, and cancellation.

2. Forward the Composio API key in Docker Compose

The server reads COMPOSIO_API_KEY, but compose.yml does not forward it to the app container. Setting it in .env as documented leaves connected apps disabled and the controls hidden for Compose deployments.

Acceptance criteria:

• Add optional COMPOSIO_API_KEY forwarding to the app service environment.
• Verify a configured key reaches the container and an omitted key keeps the integration disabled.

Validation context

Typecheck and all 307 existing tests passed at the reviewed head. The targeted startup-timeout probe failed. These are bounded follow-ups for the optional integration; they do not regress existing functionality when connected apps are disabled.