fix: add request timeouts and mask API key in repr

[planetf1]

Add explicit timeouts to two previously unbounded requests calls, and
mask the API key in OpenAIBackend.__repr__ / __str__.

Timeouts

RESTHandler.emit() uses timeout=2: this handler fires synchronously
on every log event, so a slow or unreachable webhook endpoint would block
the calling thread on every log write. 2 s is enough to confirm liveness;
beyond that the record should be dropped.

is_vllm_server_with_structured_output() uses timeout=10: this probe
runs once at OpenAIBackend.__init__() time, not on every request, so a
longer timeout costs nothing in throughput. vLLM's /version endpoint is
trivial (no GPU path), but cloud or VPN round-trips can be slow; 10 s covers
realistic slow-network cases while still failing fast on a dead server. A
false timeout here silently degrades structured output behaviour, so erring
toward patience is correct.

API key masking

__repr__ and __str__ previously fell back to Python's default object repr — safe, but not very useful. Both now return a structured repr showing model_id and base_url, with the API key replaced by ***. The masking is defensive: if the repr is later extended, the key is already guarded.

Identified in the 2026-05-12 security audit. Ref #1246. Follow-up to cover other backends: #1317.

[planetf1]

Awaiting review - any chance you could take a look @AngeloDanducci

[AngeloDanducci]

Will take a look today 👍

[AngeloDanducci]

Looks mostly good - couple of tests to be added just to cover all the bases I think.

[AngeloDanducci]

LGTM feedback addressed.

[planetf1]

@nrfulton @jakelorocco — this PR has been open for 7 days and has one approval. It needs a sign-off from a CODEOWNER of mellea/core/ (which is the two of you). Would appreciate a look when you can.

[jakelorocco]

The timeout defaults seem reasonable to me.

@planetf1, I don't understand this comment:

`repr` and `str` previously inherited the default object repr,
which could expose the API key in logs, exception messages, or debug output.
Both now return `***` in place of the key.

Identified in the 2026-05-12 security audit.

For objects that don't define str, it's my understanding that Python falls back to the repr method. The default repr method for Backends should just be <mellea.backends.openai.OpenAIBackend object at 0x101db7920>. I don't understand where the credential leaking is coming from. I do agree though: we could have nicer output for backends. But we should then probably handle all of the backends.

[planetf1]

@jakelorocco Fair point — the default repr is just <ClassName object at 0x...>, nothing leaks.

The motivation was more "give it a useful repr that's safe by default" — if someone later adds attributes or converts to a dataclass, the key's already masked from the start. I'll update the description to say that.

Agreed on the other backends — filed #1317 to cover them.