feat(auth-curl): add --max-time / --connect-timeout passthrough to curl

[pchuri]

Summary

Adds --max-time <seconds> (and the commonly-paired sibling --connect-timeout <seconds>) to the auth-curl command, passing the value straight through to the underlying curl invocation.

auth-curl advertises itself as "curl with automatic Chrome cookie authentication", so tools that generate invocations naturally assume it mirrors curl's common flags. Before this change, auth-curl --max-time 20 "URL" failed with error: unknown option '--max-time' (exit 1).

This unblocks generated auth-curl --max-time calls — context: a watchtell alarm checker generates such invocations and was erroring out.

Changes

• New commander options --max-time <seconds> and --connect-timeout <seconds>.
• Both values are validated as positive numbers; invalid input (e.g. --max-time notanumber) fails cleanly with a clear message and non-zero exit instead of passing garbage to curl.
• When present, --max-time N / --connect-timeout N are forwarded into the built curlArgs.
• Documented in --help examples and the README (auth-curl section + options table).
• New tests/auth-curl.test.ts asserting --max-time 20 appears in the built curl command, plus the sibling flag, absence, and invalid-input cases. Tests mock/inspect the built curl args — no live network or real cookies.

Testing

• npx jest — 39 tests pass (8 suites).
• tsc --noEmit clean; eslint 0 errors (pre-existing warnings only).

Notes

• Surgical change: only the new options + passthrough + validation + docs + a test. No refactor of the cookie/curl logic.
• The security CI job (npm audit) may show red for an unrelated, known reason (tracked separately as cce-ci-audit-fix); the test checks must pass.

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 1.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀