The current implementation uses urllib.request with no timeout. A hung LLM provider will hang the Vera runtime indefinitely.

Add a configurable timeout (default 30s) overridable via VERA_INFERENCE_TIMEOUT env var. Return Err("inference timeout after 30s") on expiry.

req = _urlreq.Request(url, data=body, headers=headers, method="POST")
resp = _urlreq.urlopen(req, timeout=timeout_secs)

Apply the same timeout to the JS browser runtime's XHR call.