fix(tests): stop committing node passwords + bound multinode RPC calls (§H)

- multinode suites no longer carry real node passwords as defaults: *_PW
  vars are required, auto-loaded from git-ignored tests/multinode/.env
  (lib sources it; .env.example documents the shape). Suites fail fast
  with a clear message when unset.
- node_login/node_rpc get --connect-timeout 10 --max-time 120 (override:
  MULTINODE_RPC_TIMEOUT) so one hung server-side RPC can't stall the whole
  suite. Verified live: login+rpc against .116 OK; unroutable node fails
  in 10s instead of hanging.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/multinode/lib/multinode.bash

@@ -11,18 +11,27 @@
 #
 # Usage:
 #   source tests/multinode/lib/multinode.bash
-#   node_register A https://192.168.1.228 password123
-#   node_register B http://192.168.1.116  'ThisIsWeb54321@'
+#   node_register A https://192.168.1.228 "$A_PW"
+#   node_register B http://192.168.1.116  "$B_PW"
 #   node_login A; node_login B
 #   node_rpc A node.tor-address
 #   node_result B federation.list-nodes
 #
 # Requires: curl, jq.
 #
+# Credentials: node passwords are NEVER committed. Export *_PW env vars, or
+# put them in tests/multinode/.env (git-ignored; see .env.example) — sourced
+# automatically below so every suite picks them up.
+#
 # Note: this is a library — it does NOT set shell options (set -u/-e), since
 # that would leak into the sourcing script. Each function guards its own vars
 # with ${var:-} defaults. Callers set their own options.
 
+# Auto-load git-ignored local credentials (tests/multinode/.env), if present.
+_MN_ENV_FILE="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)/.env"
+# shellcheck disable=SC1090
+[[ -f "$_MN_ENV_FILE" ]] && source "$_MN_ENV_FILE"
+
 # Where per-node session state lives (one file per handle).
 MULTINODE_STATE_DIR="${MULTINODE_STATE_DIR:-/tmp/archy-multinode}"
 mkdir -p "$MULTINODE_STATE_DIR"
@@ -52,7 +61,8 @@ node_login() {
   fi
   local headers; headers=$(mktemp)
   local body
-  body=$(curl -sk -D "$headers" -X POST "${url}/rpc/v1" \
+  body=$(curl -sk --connect-timeout 10 --max-time "${MULTINODE_RPC_TIMEOUT:-120}" \
+    -D "$headers" -X POST "${url}/rpc/v1" \
     -H 'Content-Type: application/json' \
     --data-raw "{\"jsonrpc\":\"2.0\",\"method\":\"auth.login\",\"params\":{\"password\":\"${pw}\"},\"id\":1}")
   local err; err=$(echo "$body" | jq -r '.error.message // empty' 2>/dev/null)
@@ -90,7 +100,10 @@ node_rpc() {
   else
     payload=$(jq -nc --arg m "$method" --argjson p "$params" '{jsonrpc:"2.0",method:$m,params:$p,id:1}')
   fi
-  curl -sk -X POST "${url}/rpc/v1" \
+  # Bounded so one slow/hung server-side RPC can't hang the whole suite;
+  # override per-run with MULTINODE_RPC_TIMEOUT (seconds).
+  curl -sk --connect-timeout 10 --max-time "${MULTINODE_RPC_TIMEOUT:-120}" \
+    -X POST "${url}/rpc/v1" \
     -H 'Content-Type: application/json' \
     -H "Cookie: session=${session}; csrf_token=${csrf}" \
     -H "X-CSRF-Token: ${csrf}" \