fix: prevent infinite loading screen by adding sweep timeouts

The dashboard would hang indefinitely on the loading screen because:

1. `bls.mjs` used a raw `fetch()` without any timeout/AbortSignal —
   if the BLS API was slow or unresponsive, it would block forever.

2. `runSource()` in `briefing.mjs` had no per-source timeout, so a
   single hanging API could stall the entire sweep indefinitely.

3. `server.mjs` loaded cached `latest.json` via a fire-and-forget
   promise (`.then()`) instead of `await`, meaning the dashboard
   never received the cached data before the sweep started.

4. `loading.html` relied solely on SSE for redirect — if the SSE
   connection missed the update event, the page would never redirect.

Changes:
- Add 15s AbortController timeout to BLS `getSeries()` fetch call
- Add 30s per-source timeout via `Promise.race()` in `runSource()`
- Await `synthesize()` when loading cached data so the dashboard
  serves instantly on restart when `runs/latest.json` exists
- Add 5s fallback polling to loading page alongside SSE

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apis/briefing.mjs

@@ -43,10 +43,16 @@ import { briefing as space } from './sources/space.mjs';
 // === Tier 5: Live Market Data ===
 import { briefing as yfinance } from './sources/yfinance.mjs';
 
+const SOURCE_TIMEOUT_MS = 30_000; // 30s max per individual source
+
 export async function runSource(name, fn, ...args) {
   const start = Date.now();
   try {
-    const data = await fn(...args);
+    const dataPromise = fn(...args);
+    const timeoutPromise = new Promise((_, reject) =>
+      setTimeout(() => reject(new Error(`Source ${name} timed out after ${SOURCE_TIMEOUT_MS / 1000}s`)), SOURCE_TIMEOUT_MS)
+    );
+    const data = await Promise.race([dataPromise, timeoutPromise]);
     return { name, status: 'ok', durationMs: Date.now() - start, data };
   } catch (e) {
     return { name, status: 'error', durationMs: Date.now() - start, error: e.message };
@@ -57,7 +63,7 @@ export async function fullBriefing() {
   console.error('[Crucix] Starting intelligence sweep — 27 sources...');
   const start = Date.now();
 
-  const results = await Promise.allSettled([
+  const allPromises = [
     // Tier 1: Core OSINT & Geopolitical
     runSource('GDELT', gdelt),
     runSource('OpenSky', opensky),
@@ -94,7 +100,11 @@ export async function fullBriefing() {
 
     // Tier 5: Live Market Data
     runSource('YFinance', yfinance),
-  ]);
+  ];
+
+  // Each runSource has its own 30s timeout, so allSettled will resolve
+  // within ~30s even if APIs hang. Global timeout is a safety net.
+  const results = await Promise.allSettled(allPromises);
 
   const sources = results.map(r => r.status === 'fulfilled' ? r.value : { status: 'failed', error: r.reason?.message });
   const totalMs = Date.now() - start;

apis/sources/bls.mjs

@@ -37,11 +37,15 @@ export async function getSeries(seriesIds, opts = {}) {
   if (apiKey) payload.registrationkey = apiKey;
 
   try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 15000);
     const res = await fetch(base, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(payload),
+      signal: controller.signal,
     });
+    clearTimeout(timer);
     return await res.json();
   } catch (e) {
     return { error: e.message };