fix: nightly hardening - fetch timeout validation

[mouse-value-add]

Problem

loadFromUrl() accepted any numeric timeout, including invalid values like 0, negatives, or non-finite numbers. That can trigger immediate aborts or unpredictable behavior in remote profile loading.

Approach

• Added timeout normalization in the parser to enforce sane fetch timeout values.
• Invalid timeout values now safely fall back to DEFAULT_FETCH_TIMEOUT.
• Timeout values are floored to integer milliseconds before use.
• Added a parser test to verify fallback behavior for invalid timeout inputs.

Verification

• Ran full test suite: npm test --silent (all tests passing).
• Added test: test/parser/loadFromUrl.test.ts case for invalid timeout fallback.

Risks

• Minimal behavior change: callers that previously relied on invalid timeout values (for example 0) will now get default timeout behavior.

Rollback Plan

• Revert commit 3b3b188 to restore prior timeout handling behavior.