[TroyHernandez]

Summary

• Give every HTTP request a finite deadline, so a stalled connection cannot hold a polling loop indefinitely. JSON requests, streaming upload, and authenticated download share one handle constructor.
• Defaults: 10 seconds to connect, 60 seconds per ordinary request, 300 seconds per media transfer. Sync and federated key query/claim add their server-side wait to the total, so a 30-second sync allows 90 seconds.
• New options, in seconds: mx.api.connect_timeout, mx.api.request_timeout, mx.api.media_timeout.
• Timeout errors propagate to the caller. The transport does not replay requests, since a timed-out send may already have succeeded.
• Prepare the 0.4.0 release: version bump, NEWS heading, refreshed cran-comments.md.

No exported signature changes and no new dependencies.

Verification

• Source suite against a fresh 0.4.0 install in an isolated library: 339 assertions, 0 failures. 97 of them cover the deadlines, including loopback HTTP and TLS stalls.
• R CMD check --as-cran --run-donttest on the 0.4.0 tarball: Status: OK.
• R CMD build output carries no warnings.
• checktor 0.2.0: no policy or robustness findings.
• Reverse dependencies, CRAN sources checked against 0.4.0: mx.client 0.2.1, chat.api 0.1.0, and mx.crypto 0.2.2 finish Status: OK. corteza 0.7.1 fails 1 default-model assertion of 2563; it fails identically against the previous mx.api, so it is independent of this change.