fix: add HTTP timeouts and handle ignored errors

Add 15s timeout to FetchRemoteConfig and 30s timeout to snapshot upload/import HTTP clients. Fix ignored io.ReadAll error and unhandled exec.Command("open") error in snapshot upload.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: fullstackjam

internal/cli/snapshot.go

@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/charmbracelet/lipgloss"
 	"github.com/openbootdotdev/openboot/internal/auth"
@@ -226,14 +227,18 @@ func uploadSnapshot(snap *snapshot.Snapshot) error {
 	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", stored.Token))
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := http.DefaultClient.Do(req)
+	uploadClient := &http.Client{Timeout: 30 * time.Second}
+	resp, err := uploadClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to upload snapshot: %w", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		respBody, _ := io.ReadAll(resp.Body)
+		respBody, err := io.ReadAll(resp.Body)
+		if err != nil {
+			return fmt.Errorf("upload failed (status %d): failed to read response: %w", resp.StatusCode, err)
+		}
 		return fmt.Errorf("upload failed (status %d): %s", resp.StatusCode, string(respBody))
 	}
 
@@ -259,7 +264,9 @@ func uploadSnapshot(snap *snapshot.Snapshot) error {
 	fmt.Fprintln(os.Stderr)
 
 	// Auto-open browser
-	exec.Command("open", configURL).Start()
+	if err := exec.Command("open", configURL).Start(); err != nil {
+		ui.Warn(fmt.Sprintf("Could not open browser: %v", err))
+	}
 	fmt.Fprintln(os.Stderr, snapMutedStyle.Render("  Opening in browser..."))
 	fmt.Fprintln(os.Stderr)
 
@@ -324,7 +331,8 @@ func runSnapshotImport(importPath string, dryRun bool) error {
 	localPath := importPath
 	if strings.HasPrefix(importPath, "http://") || strings.HasPrefix(importPath, "https://") {
 		fmt.Fprintf(os.Stderr, "  Downloading snapshot from %s...\n", importPath)
-		resp, err := http.Get(importPath)
+		client := &http.Client{Timeout: 30 * time.Second}
+		resp, err := client.Get(importPath)
 		if err != nil {
 			return fmt.Errorf("failed to download snapshot: %w", err)
 		}

internal/config/config.go

@@ -7,10 +7,15 @@ import (
 	"log"
 	"net/http"
 	"strings"
+	"time"
 
 	"gopkg.in/yaml.v3"
 )
 
+var remoteHTTPClient = &http.Client{
+	Timeout: 15 * time.Second,
+}
+
 //go:embed data/presets.yaml
 var presetsYAML embed.FS
 
@@ -95,7 +100,7 @@ func FetchRemoteConfig(userSlug string) (*RemoteConfig, error) {
 
 	url := fmt.Sprintf("https://openboot.dev/%s/%s/config", username, slug)
 
-	resp, err := http.Get(url)
+	resp, err := remoteHTTPClient.Get(url)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch config: %w", err)
 	}