build: require pytest-timeout, so a hung test fails instead of hanging CI

pytest.ini has carried `timeout = 30` and `timeout_method = signal` with a comment
asking that it not be removed, but pytest-timeout was never declared in
requirements.txt.  CI installs only that file, so the options were unknown there,
pytest warned and carried on, and the timeout has never once applied in CI.  A
hung test ran until CircleCI killed the job, which reports no test name at all --
and when the hang took an xdist worker with it, the rest of that worker's tests
came back as a wall of EOFError, burying the actual cause.

It goes in requirements.txt rather than a dev-only file because this project has
no testing-only dependencies: a WROLPi is expected to run, test, and develop on
the device, so the four Dockerfiles that install this file get it too.

Verified: the unknown-option warnings are gone, a deliberately hung test now fails
with "Timeout (>30.0s) from pytest-timeout" naming the test, and the full suite
passes with the timeout in force -- 1709 passed under -nauto, so no legitimate
test is near the limit locally.

Worth watching: this is a behaviour change for CI, which has never enforced it.
CircleCI runs on 4 vCPU with -nauto, so a test that takes ten seconds here could
take longer there.  If timeouts appear in CI the number is the thing to raise, not
the plugin to drop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

requirements.txt

@@ -15,6 +15,11 @@ psutil==7.2.2
 pydantic>=2.0.0
 PyMuPDF>=1.27.2.3
 pytest-asyncio==1.4.0
+# pytest.ini sets `timeout = 30` and asks that it not be removed, but this was never declared
+# here -- so on any machine without it, and in CI, which installs only this file, the option was
+# unknown and the timeout never applied.  A hung test then runs until the CI job itself is
+# killed, with no indication of which test hung.
+pytest-timeout==2.4.0
 pytest-xdist==3.8.0
 pytest==9.0.3
 py7zr>=1.1.3