Add timeout policy and route-prefix guardrails for TinyPen adapter

Deep seam scan found cross-service drift risks around TinyPen integration.`n`nFindings:`n- TPEN-services TinyPen adapter does not clearly enforce request timeout policy equivalent to TinyPen upstream timeout defaults.`n- TinyNode/TinyPen route-prefix variance (`/app/*` vs root routes) has ecosystem break potential and is now tracked in related issues.`n`nRequested adjustment:`n1. Add explicit timeout configuration + enforcement for TinyPen adapter calls.`n2. Add integration tests that pin expected TinyPen route base/prefix behavior.`n3. Document migration path if route prefix conventions change.`n`nFiled from contract seam scan; label: copilot.