fix: patch three critical defects from the SDK review

- local delete_collection: validate the collection name before rmtree.
  An unvalidated name like "../.." escaped files_dir and deleted
  arbitrary directories (path traversal).

- legacy page_index(): restore the node_id/summary/text/description
  enhancements. IndexConfig now carries booleans (pydantic coerces the
  legacy 'yes'/'no' strings at the boundary), but page_index_main still
  compared `opt.if_add_node_id == 'yes'` — always False — so every
  enhancement was silently skipped for legacy-API callers. Conditions
  now branch on the booleans, matching pageindex/index/page_index.py.

- LegacyCloudAPI._request: bound every request with a timeout
  (30s, 120s read timeout for streamed responses) so a dead connection
  can't hang legacy submit/poll/chat callers forever. The legacy
  contract tests pinned the missing timeout; updated to pin its
  presence instead.

Adds regression tests: path-traversal rejection, 'yes'/'no' -> bool
coercion, and timeout assertions.

Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

tests/test_config.py

@@ -26,3 +26,11 @@ def test_model_copy_with_update():
     updated = config.model_copy(update={"model": "gpt-5.4"})
     assert updated.model == "gpt-5.4"
     assert updated.toc_check_page_num == 30
+
+
+def test_legacy_yes_no_strings_coerce_to_bool():
+    """Legacy page_index()/run_pageindex callers pass 'yes'/'no' strings;
+    pydantic must coerce them to the booleans the pipeline now branches on."""
+    config = IndexConfig(if_add_node_id="yes", if_add_node_summary="no")
+    assert config.if_add_node_id is True
+    assert config.if_add_node_summary is False