fix: Add explicit connect/max-time timeouts to curl and ssh calls

Run #2005's Health Check job hung for 18+ minutes (well past its own
timeout-minutes: 10) instead of failing within seconds. Killed the
zombie container manually via 'docker kill' on the runner host.
Root cause: the pre-fix curl calls to the unreachable
$DEPLOY_HOST:5000 had no --connect-timeout/--max-time, so each of the
20 retry attempts could hang on the OS's default TCP timeout instead
of failing fast; the job-level timeout-minutes didn't reliably cut it
off either (act_runner enforcement gap, not something we control from
the workflow file).

This is now largely moot after the previous commit (health checks run
against 127.0.0.1 on the server itself, where curl returns
near-instantly), but added explicit timeouts everywhere as a second
line of defense against the same failure mode recurring:
- Gitea API curl calls (release fetch, artifact download):
  --connect-timeout 10 --max-time 30/120
- Local 127.0.0.1 health-check curls: --connect-timeout 5 --max-time 10
- All ssh/scp invocations: -o ConnectTimeout=10

No single curl or ssh call in this workflow should now be able to
hang indefinitely.

.gitea/workflows/deploy-prod.yml

@@ -59,7 +59,7 @@ jobs:
             RELEASE_URL="https://gitea.taxbaik.com/api/v1/repos/$REPO/releases/tags/$RELEASE_INPUT"
           fi
 
-          RELEASE=$(curl -sf -H "Authorization: token $TOKEN" "$RELEASE_URL")
+          RELEASE=$(curl -sf --connect-timeout 10 --max-time 30 -H "Authorization: token $TOKEN" "$RELEASE_URL")
           TAG=$(echo "$RELEASE" | jq -r '.tag_name')
           # NOTE: '.target_commitish' is the branch name the tag was cut from
           # (e.g. "main"), NOT a commit SHA -- do not use it as a commit hash.
@@ -95,7 +95,7 @@ jobs:
           DOWNLOAD_URL="${{ steps.fetch.outputs.download_url }}"
 
           echo "Downloading: $DOWNLOAD_URL"
-          curl -sfL -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL"
+          curl -sfL --connect-timeout 10 --max-time 120 -H "Authorization: token $TOKEN" -o "$ARTIFACT" "$DOWNLOAD_URL"
 
           # A 404/error page would still create a small file -- verify it's a
           # real gzip archive, not an HTML/JSON error body (this is exactly
@@ -151,6 +151,7 @@ jobs:
           scp -i ~/.ssh/deploy_key \
             -P ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             "$ARTIFACT" ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }}:/tmp/
           echo "✓ Release artifact uploaded"
 
@@ -174,6 +175,7 @@ jobs:
           ssh -i ~/.ssh/deploy_key \
             -p ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} \
             "ARTIFACT='$ARTIFACT' RELEASE_TAG='$RELEASE_TAG' COMMIT='$COMMIT' SERVICE_NAME='$SERVICE_NAME' bash -s" << 'REMOTE'
           set -e
@@ -271,6 +273,7 @@ jobs:
           ssh -i ~/.ssh/deploy_key \
             -p ${{ env.DEPLOY_PORT }} \
             -o StrictHostKeyChecking=accept-new \
+            -o ConnectTimeout=10 \
             ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s << 'REMOTE'
           set -e
           ATTEMPTS=20
@@ -278,18 +281,18 @@ jobs:
           echo "【 Health Checks (max ${ATTEMPTS} attempts) 】"
 
           for i in $(seq 1 $ATTEMPTS); do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000")
+            HTTP_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "000")
             if [ "$HTTP_CODE" = "200" ]; then
               echo "✓ [1/6] HTTP 200 OK (attempt $i)"
 
-              LOGIN_BODY=$(curl -s http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "")
+              LOGIN_BODY=$(curl -s --connect-timeout 5 --max-time 10 http://127.0.0.1:5000/Account/Login 2>/dev/null || echo "")
               if echo "$LOGIN_BODY" | grep -q "login\|Login\|로그인"; then
                 echo "✓ [2/6] Login page content verified"
               else
                 echo "⚠ [2/6] Login page content verification skipped"
               fi
 
-              CSS_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000")
+              CSS_CODE=$(curl -s --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/css/admin.css 2>/dev/null || echo "000")
               if [ "$CSS_CODE" = "200" ]; then
                 echo "✓ [3/6] CSS file loaded"
               else