API timeout handling configured

Route handlers that call external services (AI APIs, payment processors, email providers, slow database queries) with no timeout configuration can hang for the full platform timeout — 30+ seconds on Vercel — blocking the response and consuming a serverless function invocation slot. In serverless environments, this does not just affect the single user: it contributes to concurrency exhaustion (CWE-400, CWE-770) and drives up cost proportionally with hang duration. ISO-25010:2011 reliability.fault-tolerance requires that slow dependencies do not cascade into application-level failures.

Add timeout handling in app/api/ route handlers for every external call using AbortController, and declare maxDuration in route files that need extended execution time:

// app/api/ai/generate/route.ts
export const maxDuration = 30 // seconds — declare for Vercel

export async function POST(req: Request) {
  const controller = new AbortController()
  const timeout = setTimeout(() => controller.abort(), 8000) // 8s per-call limit

  try {
    const response = await fetch(AI_API_URL, {
      method: 'POST',
      body: JSON.stringify(payload),
      signal: controller.signal,
    })
    clearTimeout(timeout)
    return apiSuccess(await response.json())
  } catch (err) {
    if (err instanceof Error && err.name === 'AbortError') {
      return apiError('TIMEOUT', 'Upstream service timed out', 504)
    }
    throw err
  }
}

Return 504 (Gateway Timeout) rather than letting the connection hang until the platform terminates it.