feat: per-job command timeout with global default

Add an optional per-job run timeout following the overlap_policy inherit
pattern: Job.TimeoutSeconds (0 = inherit) resolves against a new
Config.DefaultTimeoutSeconds (default 30s), replacing the hard-coded 30s
guard in runner.RunJob.

- domain/storage: new fields, default 30, load-time normalization
- runner: RunJob takes an explicit timeout; StartOnly stays untimed so it
  keeps measuring launch latency only
- app: effectiveTimeout resolves under mu into runEnv, threaded to runJob;
  seam signature and validation updated; DisplayTimeout helper
- ui: Timeout entry in the job dialog, Default timeout in Settings, and a
  Timeout row in the details panel
- tests + docs (ARCHITECTURE, STANDARDS, ROADMAP, CHANGELOG) updated;
  version bumped to 0.12.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/operations.go

@@ -367,6 +367,9 @@ func validateJob(job domain.Job) error {
 	if policy != "" && policy != string(domain.OverlapPolicySkip) && policy != string(domain.OverlapPolicyQueue) {
 		return errors.New("overlap policy must be 'skip', 'queue', or empty")
 	}
+	if job.TimeoutSeconds < 0 {
+		return errors.New("timeout must be zero (inherit) or a positive number of seconds")
+	}
 	return nil
 }
 
@@ -390,5 +393,8 @@ func validateConfig(config domain.Config) error {
 	if config.OverlapPolicy != domain.OverlapPolicySkip && config.OverlapPolicy != domain.OverlapPolicyQueue {
 		return errors.New("overlap policy must be 'skip' or 'queue'")
 	}
+	if config.DefaultTimeoutSeconds <= 0 {
+		return errors.New("default timeout must be a positive number of seconds")
+	}
 	return nil
 }