chore: harden gitignore for secrets

feat: configurable stream stall timeout + per-provider UI