[Bug]: Provider update prompt never shows when npm registry lookup exceeds the hardcoded 4s timeout

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Run T3 Code on a machine where DNS resolution is slow on cold lookups (mine goes through a local filtering resolver; registry.npmjs.org takes 11-14s to resolve the first time, ~0.4s once warm).
2. Have an outdated Claude Code (or any npm-managed provider) installed via npm i -g.
3. Open T3 Code and wait.

$ curl -s -o /dev/null -w "dns=%{time_namelookup}s total=%{time_total}s\n" https://registry.npmjs.org/%40anthropic-ai%2Fclaude-code/latest
dns=11.231198s total=11.568347s
dns=0.007778s total=0.399317s

Expected behavior

The "provider update available" toast shows up, like it used to for me.

Actual behavior

No toast ever appears. Settings > Providers still shows the update button and the one-click update works fine, so the maintenance capability detection is right; only the latest-version check is failing.

From reading the server bundle: fetchNpmLatestVersion wraps the registry request in timeoutOption(LATEST_VERSION_TIMEOUT_MS) with LATEST_VERSION_TIMEOUT_MS = 4e3. When it times out it returns null, resolveLatestProviderVersion caches that null for LATEST_VERSION_CACHE_TTL_MS = 36e5 (1 hour), and deriveVersionAdvisory yields status: "unknown", so the client's behind_latest gate never fires. One slow DNS hit at startup silences the prompt for an hour, and every hourly retry has to beat the same 4s window.

Suggestions, any one of which would fix it for me:

• Bump the timeout (10-15s) or make it configurable.
• Don't cache a null result for the full hour; retry sooner on failure.
• Log the timeout somewhere visible so it's not a silent "unknown".

Impact

Minor bug or occasional failure

Version or commit

T3 Code (Alpha) 0.0.40.0, Claude Code provider 2.1.263 (latest 2.1.268)

Environment

Windows 11 Pro 10.0.26200, Claude provider installed via npm i -g @anthropic-ai/claude-code, binaryPath pointed at %APPDATA%\npm\node_modules\@anthropic-ai\claude-code\bin\claude.exe

Start in apps/server by locating fetchNpmLatestVersion, resolveLatestProviderVersion, deriveVersionAdvisory, timeoutOption, and the LATEST_VERSION_TIMEOUT_MS and LATEST_VERSION_CACHE_TTL_MS constants. Reproduce with a slow cold lookup, then verify that the provider update toast can still appear when the registry request exceeds four seconds and that failed lookups do not silently suppress it for an hour.