fix: patch path traversal and missing HTTP timeouts

[cursor]

Security Fixes

Addresses two vulnerabilities found during an automated security scan.

1. Path traversal via unencoded path parameters

Severity: Medium

All 17 service modules used str.replace() to interpolate user-supplied IDs into URL path templates without URL encoding. The requests library normalizes ../ sequences during URL preparation, so a crafted ID (e.g. ../../admin/settings) could redirect authenticated requests to unintended API endpoints — bypassing the SDK's "public routes only" design.

Fix: Added a _safe_path_param() helper in client_base.py that applies urllib.parse.quote(str(value), safe="") and updated all 40 path parameter interpolations across 17 service files to use it.

Before:

path = path.replace("{id}", str(id))

After:

path = path.replace("{id}", _safe_path_param(id))

2. HTTP client denial of service via missing request timeouts

Severity: Medium

The SDK's _request() method called session.request() without any timeout parameter. The requests library defaults to None (infinite wait), meaning every HTTP call could block indefinitely if the API server is slow or unresponsive — leading to worker thread exhaustion in consuming applications.

Fix: Added a configurable timeout constructor parameter (default 30s) to LomiClient that is passed to every session.request() call.

client = LomiClient(api_key="...", timeout=60)  # custom timeout
client = LomiClient(api_key="...")               # uses 30s default

Testing

• Existing test suite passes (the one pre-existing failure in test_generated_surface.py is unrelated — it references a payment_intents attribute that doesn't exist on LomiClient)
• Verified URL encoding: _safe_path_param("../../admin") → ..%2F..%2Fadmin
• Verified timeout is set: LomiClient(api_key="test").timeout → 30