fix: enforce configured request timeout

[bufo24]

Problem

ClientConfig.timeoutMs is accepted, documented (default 30s), and resolved into ResolvedClientConfig — but never used. The GraphQLClient was constructed with only fetch and headers, no signal:

this.graphqlClient = new GraphQLClient(this.config.baseUrl, {
  fetch: this.config.fetch,
  headers: this.buildHeaders(),
});

So a hung or slow server would block a request indefinitely, and the timeoutMs option (and its default) silently did nothing.

Fix

Wrap the configured fetch so every request carries AbortSignal.timeout(timeoutMs), while honoring a caller-supplied signal if one is passed:

fetch: (input, init) =>
  fetchImpl(input, { ...init, signal: init?.signal ?? AbortSignal.timeout(timeoutMs) }),

This applies to both the gqlRequest path and the resource SDK path (getSdk(graphqlClient)), since both share the client's fetch.

Tests

Two added to client.test.ts:

• requests carry an AbortSignal derived from timeoutMs
• a request exceeding timeoutMs rejects

AbortSignal.timeout requires Node ≥17.3 — well within the SDK's Node ≥18.18 floor.

Note

This is a genuine fix: (touches packages/core), so it will trigger a release-please PR for @ambosstech/core.