TimeoutError not handled in validateToken()

[weiyentan]

Summary

createTimeoutSignal() aborts with a DOMException named "TimeoutError", but validateToken() special-cases only "AbortError" as the timeout path. A real init-time timeout may fall through to the generic "Cannot reach AAP" message rather than the nicer "Timeout connecting to AAP" message.

Fix

Add "TimeoutError" alongside "AbortError" in the validateToken() error handler:

if (
  err instanceof DOMException &&
  (err.name === "AbortError" || err.name === "TimeoutError")
) {
  return {
    valid: false,
    error: [
      `Timeout connecting to AAP at ${baseUrl}.`,
      `Check your baseUrl in opencode.jsonc and ensure the AAP instance is reachable.`,
    ].join(" "),
    status: null,
  };
}

Acceptance Criteria

• validateToken() returns the "Timeout connecting to AAP" message when the signal aborts with TimeoutError
• Existing AbortError path continues to work
• All existing tests pass

Notes

Low-risk, single-file change. Was noted as a follow-up polish item during PR review.