fix: add fetch timeouts to Limitless and test server

[realfishsam]

Summary

• Add a 30s timeout to the Limitless SDK HttpClient instances used by the fetcher.
• Wrap the local test-server fetch calls with AbortSignal.timeout so the demo script can't hang indefinitely.

Verification

• node -c core/src/server/test-server.js

Fixes #680
Fixes #681

[realfishsam]

PR Review: PASS (NOT VERIFIED)

What This Does

Adds explicit fetch timeouts to Limitless HTTP calls and validates test-server timeout configuration, preventing unbounded hangs in those paths.

Blast Radius

Limitless fetcher and core test-server; PR #875 also includes the throttler overflow change.
Changed files reviewed: core/src/exchanges/limitless/fetcher.ts, core/src/server/test-server.js

Consumer Verification

Before (base branch):
Base branch (origin/main) does not include these changes. I reviewed the diff against the base and did not run full live-exchange before/after reproduction in this daily batch.

After (PR branch):
PR branch build PASS; authenticated local sidecar smoke PASS using POST /api/mock/fetchMarkets with x-pmxt-access-token, response snippet: {"success":true,"data":[{"marketId":"mock-m0","eventId":"mock-event-0","title":"Which party wins the 2026 harborland election?","description":"incididunt magna metus ut cupidatat aliquip dolore quis incididunt id do aenean aenean non dolor dolore tempor pharetra lorem fugiat aenean est voluptate ...

Test Results

• Build: PASS (npm run build --workspace=pmxt-core)
• Unit tests: PASS (npm test --workspace=pmxt-core -- --runInBand)
• Server starts: PASS
• E2E smoke: PASS (POST /api/mock/fetchMarkets; live venue-specific calls were not made)
• Dependency install: skipped (existing workspace deps reused)

Findings

No blocking findings.

PMXT Pipeline Check

• Field propagation (3-layer): N/A
• OpenAPI sync: N/A
• Financial precision: N/A
• Type safety: OK
• Auth safety: N/A

Semver Impact

patch -- bug fix/internal compatibility change unless SDK consumers rely on newly added APIs

Risk

The branch was built, core-tested, and authenticated-smoke-tested through the sidecar. Full live-exchange before/after behavior remains unverified for this daily batch; credentialed venue calls and venue API drift should be treated as residual risk unless covered by tests in this PR.