Add default timeout support to opal api proxy

[TimDanielsCQI]

Jira link

See PO-3939

Change description

This PR updates opal-frontend-common-node-lib so the shared frontend proxy no longer relies on implicit proxy behaviour for timeout and transport failures. OpalApiProxy now takes an explicit timeout value, passes it through to http-proxy-middleware, and returns a deterministic response when the upstream service times out or cannot be reached.

For timeout and network-style failures, the proxy now returns a 504 Gateway Timeout response with a consistent error body and retriable: true. For other unexpected proxy failures, it returns a 502 Bad Gateway response with retriable: false. The proxy itself does not retry requests, so read and mutation safety stays with the consuming frontend.

I also added a small source-local README under src/proxy/opal-api-proxy/README.md to document the timeout contract, the error mapping, and how the optional retry mechanism in opal-frontend-common-ui-lib can be used by consumers.

Assumptions

• The upstream service for this proxy is opal-fines-service.
• A 30 second timeout is the correct default unless a consuming app overrides it.
• The proxy should expose retryability metadata, but it should not replay requests automatically.
• Retry behaviour belongs in the frontend consumer, not in the shared proxy library.

Testing

Local Testing Completed

• Built a local common-node package from the PO-3939 branch and installed it into opal-frontend.
• Started opal-frontend locally with the PO-3939 tarball.
• Confirmed http://localhost:4200/sign-in returns 200 OK.
• Browser smoke test: stopped the local Fines Service container and repeated a safe GET request. The frontend received an immediate 504, confirming the proxy maps a connection/network failure deterministically.
• The immediate response is expected for a refused connection. The proxy can fail immediately when the upstream is unavailable; it does not need to wait 30 seconds in that case.

Testing Still Outstanding

Some things I couldn't test in the browser and will possibly need integration tests written by QA:

• A controlled opal-fines-service response delay longer than 30 seconds, to prove the actual proxyTimeout path and confirm a 504 after approximately 30 seconds.
• End-to-end verification of the fallback 502 mapping for an error outside the recognised timeout/network error-code set.
• Chrome DevTools can show one browser request, but it cannot alone prove what the server proxy did upstream.

Security Vulnerability Assessment

CVE Suppression: Are there any CVEs present in the codebase (either newly introduced or pre-existing) that are being intentionally suppressed or ignored by this commit?

• Yes
• No

Checklist

• commit messages are meaningful and follow good commit message guidelines
• README and other documentation has been updated / added (if needed)
• tests have been updated / new tests has been added (if needed)
• Does this PR introduce a breaking change

[Arnabsubedi233]

Small one

[iamfrankiemoran]

Remember to bump the library version number

[iamfrankiemoran]

You need to bump the version number in the package.json

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[TimDanielsCQI]

Changes done to this library (including readme) and opal-frontend pr

[iamfrankiemoran]

LGTM ✅

[Arnabsubedi233]

LGTM