fix(ai): run every model call under the response-timeout setting

The response-timeout setting reached the briefing, the status notes and
the Coach, which threaded it by hand. Document reads, document
extraction, lab OCR and lab staging called the provider without a
timeout, so every client fell back to its own 60 s literal and a slow
self-hosted model was cut off however high the setting stood.

The setting now rides on the provider instance. resolveProvider,
resolveProviderChain and resolveProviderForTest stamp the record's
aiResponseTimeoutSeconds on everything they return, and each wire
client reads its ceiling through callTimeoutMs: the setting, else the
surface's own timeoutMs, else 60 s. A call site no longer has to pass
it, so a new one cannot forget it. The connection test runs under the
same ceiling a read does.

The Coach nudge tick and the reaction line keep their short ceilings
(timeoutPolicy: "surface-ceiling"): the tick runs accounts one after
another under a shared budget, the reaction line's claim lease is
shorter than the largest setting, and both have deterministic copy
that stands in.

/api/auth/me publishes the effective value as
ai.provider.responseTimeoutMs, so a client can size its own request
timeout from it instead of guessing.

Refs #1090

docs/api/openapi.yaml

@@ -72185,10 +72185,19 @@ components:
           type: boolean
           description: "Whether the person in front of the screen may set up a provider for this record: false inside somebody
             else's record and while the operator's master switch is off. A setup hint is shown only when this is true."
+        responseTimeoutMs:
+          type: integer
+          exclusiveMinimum: 0
+          maximum: 9007199254740991
+          description: "How long one model call on this record may take before the server gives up, in milliseconds: the record's
+            response-timeout setting (Settings → AI), else 60000. A client that waits on a model call (a document read,
+            lab OCR) sizes its own request timeout from this plus a margin, so it never gives up before the server
+            does."
       required:
         - configured
         - managedBy
         - canConfigure
+        - responseTimeoutMs
       additionalProperties: false
       description: The account-level companion to the capability map.
     RecordSessionState: