fix: add client timeouts to prevent hung upstream connections

[cptrodgers]

Summary

• Configure reqwest::Client with connect_timeout (5s), pool settings, and per-request timeouts (30s) on non-streaming paths — SSE connections are excluded to avoid killing long-lived streams
• Add connect_timeout and request_timeout as configurable options in mcpr.toml
• Apply timeouts to all previously unprotected clients: tunnel, onboarding, and widget asset fetches

Fixes the inconsistency where only the health check client had timeouts while the main proxy client could block forever on a hung upstream.