[mikemikimike]

Summary

• Bound model-supplied HTTP fetch timeouts and response sizes, and reject non-finite timeouts.
• Reject explicitly non-text response types before reading the body while retaining support for textual JSON and XML media types.
• Add regression coverage for invalid and oversized inputs and content types.

Fixes #97
#97

Tests

• pytest tests/unit/test_tool_http_fetch.py -q (passed)
• ruff check ., ruff format --check ., and mypy agentkit tests (passed)
• pytest --cov=agentkit --cov-report=term --cov-fail-under=85 (505 passed, 1 failed on a Windows newline assertion also reproduced on the unchanged base, 30 service tests skipped)
• pytest -m real_infra tests/real -q (30 passed against PostgreSQL and Redis)

[mikemikimike]

The Windows failure in tests/unit/test_tool_read_file.py::test_read_file_nested_subdir is not introduced by this PR. I reproduced the same assertion failure on the unchanged base commit 78f0ace69cc6425a597fcfd801131ad75fa66fcb: the test writes a CRLF newline on Windows but expects LF. The full suite on this PR had 505 passed, 1 failed, and 30 service tests skipped; the base had the same failure. The 30 real PostgreSQL/Redis tests passed separately. The GitHub CI run currently requires maintainer approval and has not yet completed successfully.