feat: add timeout utility for async operations - #3

Low-risk PR adding two small utility functions in a new file. withTimeout correctly uses Promise.race with timer cleanup in .finally(), and parseTimeout validates input via regex and converts duration strings to milliseconds. No security, correctness, or error-handling defects found. The only notable points are informational: parseTimeout silently returns a default (30000ms) on invalid input rather than throwing, and TypeScript's type checker assumes the switch is exhaustive without a default — both are minor design choices, not bugs.