CLI: submit/login time out on high-latency networks (server succeeds); login error renderer crashes with 'null is not an object'

Environment: askill 0.1.15 (darwin-arm64, manually downloaded binary), high-latency network path to askill.sh (mainland China).

## 1. `askill submit ` aborts client-side while the server succeeds

`askill submit https://github.com/aaron-he-zhu/aaron-marketing-skills` consistently fails with:

```
■ The operation timed out.
└ Failed
```

But the same request via curl with a longer timeout succeeds — the indexing route just takes >60s for a 69-skill repo on a slow path:

```
curl -m 90 -X POST https://askill.sh/api/v1/submit \
-H 'Content-Type: application/json' \
-d '{"url":"https://github.com/aaron-he-zhu/aaron-marketing-skills"}'
# → 200, full per-skill JSON (all 69 already indexed, status: skipped)
```

So each earlier "failed" CLI submit had actually been processed server-side. Suggestion: raise (or make configurable) the request timeout for `submit`, and/or make the endpoint async (return a job id immediately).

## 2. `askill login --token` failure path crashes the error renderer

With a token the server rejects, the CLI prints the underlying renderer error instead of a clean message:

```
◇ Invalid token
■ null is not an object (evaluating 'error.error')
└ Login failed
```

Looks like an `error.error` access on a null/undefined body somewhere in the login flow (the guarded `error.error?.code` pattern in `src/api.ts` handles this elsewhere). On slow networks the same command also exits with a bare `Login failed` after a long `Verifying token` spinner — a timeout-vs-invalid distinction in the message would help a lot.

Happy to provide more traces if useful. (Context: the 69-skill repo above is fully indexed — thanks for the registry!)

🤖 Filed with [Claude Code](https://claude.com/claude-code)

Start with the submit and login CLI entry points, then inspect the error handling in src/api.ts, especially the guarded error.error?.code pattern mentioned in the report. Reproduce the slow submit and invalid-token login cases using the commands and responses provided. Done means submit does not report failure before the server finishes, and login shows a clean, distinct timeout or invalid-token message without crashing the renderer.

Written by the indexing model from the issue text.