fix(ehbp): raise upstream timeout default to 600s

EHBP (Tinfoil) forwarding applied a hard-coded 60-second budget to each
stage of the h11 client: TCP/TLS connect, request send, and response read.
Long reasoning or tool-calling turns can stay silent well past a minute,
so those requests were cut mid-turn and surfaced as a 504 (with the
X-Cashu path refunding the redeemed amount).

- Bump _DEFAULT_TIMEOUT_SECONDS in tinfoil_trailer.py from 60s to 600s.
  Both ehbp.py call sites rely on the default, so the X-Cashu and bearer
  paths both pick this up. The separate 1s close timeout is untouched.

Note the budget remains per-stage, not a wall-clock cap on the whole
request; it is not env-configurable.

Tests pass their own timeout_seconds explicitly, so none depend on the
previous default. The mocked timeout message in test_ehbp_timeout.py is
updated only to keep the wording consistent with the real error string.

routstr/upstream/tinfoil_trailer.py

@@ -25,7 +25,7 @@ from ..core.exceptions import EhbpTimeoutError
 logger = get_logger(__name__)
 
 _READ_BUFSIZE = 65536
-_DEFAULT_TIMEOUT_SECONDS = 60.0
+_DEFAULT_TIMEOUT_SECONDS = 600.0
 _DEFAULT_CLOSE_TIMEOUT_SECONDS = 1.0
 _DEFAULT_MAX_RESPONSE_BYTES = 25 * 1024 * 1024
 _HOP_BY_HOP_HEADERS = {

tests/unit/test_ehbp_timeout.py

@@ -105,7 +105,7 @@ async def test_bearer_timeout_propagates_504(
         "forward_with_trailer",
         AsyncMock(
             side_effect=EhbpTimeoutError(
-                "EHBP upstream inference.tinfoil.sh timed out after 60s connecting"
+                "EHBP upstream inference.tinfoil.sh timed out after 600s connecting"
             )
         ),
     )