feat(lsp): add per-dependency timeout isolation for registry fetches

[bug-ops]

Summary

• Prevents slow packages from blocking the entire fetch queue
• Each package fetch wrapped in individual timeout (default: 5s)
• Configurable concurrency limit (default: 20 concurrent requests)
• Bounds validation for security (timeout: 1-300s, concurrency: 1-100)

Problem

Previously, fetch_latest_versions_parallel() used buffer_unordered(10) without timeout isolation. If one package registry was slow (30+ seconds), it would block a concurrency slot and delay processing of all other packages.

Solution

// Each package fetch wrapped in timeout
match tokio::time::timeout(timeout, registry.get_versions(&name)).await {
    Ok(Ok(versions)) => { /* success */ }
    Ok(Err(e)) => { tracing::warn!("Failed to fetch"); None }
    Err(_) => { tracing::warn!("Fetch timed out"); None }
}

Performance Impact

Scenario	Before	After
50 deps, 1 slow package (30s)	30+ seconds	~5 seconds
Normal operation	No change	No change

Configuration

{
  "cache": {
    "fetch_timeout_secs": 10,
    "max_concurrent_fetches": 50
  }
}

Test plan

• test_fetch_latest_versions_parallel_with_timeout - Timeout works
• test_fetch_latest_versions_parallel_fast_packages_not_blocked - Fast packages complete
• test_fetch_partial_success_with_mixed_outcomes - Error handling
• test_cache_config_fetch_timeout_clamped_min/max - Bounds validation
• test_cache_config_max_concurrent_clamped_min/max - Bounds validation
• All 239 tests pass
• Clippy clean

[codecov-commenter]

Codecov Report

❌ Patch coverage is 68.60465% with 81 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/deps-lsp/src/document/lifecycle.rs	56.25%	77 Missing ⚠️
crates/deps-lsp/src/config.rs	95.12%	4 Missing ⚠️

@@            Coverage Diff             @@
##             main      #46      +/-   ##
==========================================
- Coverage   85.04%   84.99%   -0.05%     
==========================================
  Files          56       56              
  Lines       15409    15652     +243     
==========================================
+ Hits        13105    13304     +199     
- Misses       2304     2348      +44     

Flag	Coverage Δ
deps-cargo	79.75% <ø> (ø)
deps-core	90.00% <ø> (ø)
deps-go	84.99% <68.60%> (-0.05%)	⬇️
deps-lsp	78.23% <68.60%> (+0.25%)	⬆️
deps-npm	89.56% <ø> (ø)
deps-pypi	86.70% <ø> (ø)
overall	84.99% <68.60%> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
crates/deps-lsp/src/config.rs	98.10% <95.12%> (-1.05%)	⬇️
crates/deps-lsp/src/document/lifecycle.rs	55.57% <56.25%> (+6.50%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.