feat(http): add configurable request timeout

[gaokevin1]

Fixes: https://github.com/descope/etc/issues/17203

What changed

Adds a single requestTimeout config option (seconds, default 60) that bounds every HTTP call the SDK makes, plus a built-in 10s connection-establishment timeout. An optional httpClient can be supplied for full transport control.

$descopeSDK = new DescopeSDK([
    'projectId'      => $_ENV['DESCOPE_PROJECT_ID'],
    'requestTimeout' => 10, // Optional, seconds (default: 60)
]);

Why

Both Guzzle clients (API and SDKConfig) were built with new Client() and no timeout options, so a slow or unresponsive peer could hang a PHP worker indefinitely — bounded in practice only by PHP's default_socket_timeout. The JWKS fetch in SDKConfig was fully unbounded.

Design — parity with the sibling SDKs

This intentionally matches the single-knob design shared by the Go SDK (RequestTimeout) and Python SDK (timeout_seconds) rather than introducing a larger surface. The timeout is applied as a default option at client construction, so executeWithRetry and the request methods are unchanged. Retry semantics stay per-attempt, consistent with Go/Python.

• requestTimeout accepts a positive int/float/numeric-string; invalid values throw InvalidArgumentException.
• When a caller supplies their own httpClient, the SDK uses it verbatim and does not override its timeouts.

Tests

New APIHttpTimeoutTest (12 tests) covering defaults, configured values, injected-client passthrough, and validation. Full suite: 94 passing.

Supersedes #130

Replaces #130 with a lighter design that stays consistent across the Descope SDK family. Also fixes a bug in that PR where an injected client's own timeouts were overridden. The one idea from #130 not carried over is a separate managementRequestTimeout — left out for cross-SDK parity; can be revisited if there's demand.

🤖 Generated with Claude Code

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

The review assignment prioritizes contributors with broad involvement in core SDK files and testing, ensuring comprehensive evaluation of the new configurable request timeout feature.

Reviewer	Reason
omercnet	omercnet has contributed extensively to multiple core files including API.php and SDK configurations, indicating a broad understanding of the SDK's structure and HTTP handling.
dorsha	dorsha has also made significant contributions across key files, including API.php and the test suite, providing valuable insights into both implementation and testing of the HTTP timeout features.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Adds a single requestTimeout config option (default 60s) plus a built-in 10s connect timeout, bounding every SDK HTTP call, with optional httpClient passthrough.

No issues found — good bones! Traced all paths: array-union client options, API import in SDKConfig, resolveRequestTimeout validation (rejects bool/0/negative/non-numeric, guards INF/NAN), and injected-client verbatim passthrough all check out. New constructor params are optional → backward compatible, and tests match the implementation. Woof!