Declare maxDuration on /api/image, then set fetchImage timeout bound from sampled data

Follow-up to PLUTO-696 (instrumentation half, shipped a3d1e16/v2.22.83). No queryable latency data existed anywhere (no duration field in appEvents, Vercel exposes no per-invocation timing), so coder instrumented upstreamMs on fetchImage's HTTP-error and transport-failure paths instead of guessing a bound. /api/image currently declares no maxDuration, so it inherits the account default ceiling — any AbortSignal bound set above that ceiling is dead code, the platform kill fires first (same class of defect coder flagged in Mars's errno branch). Once the upstreamMs sample accumulates, db-pluto-cc reads the tail and coder sets the explicit maxDuration + the abort bound together in one change, since raising maxDuration changes the route's failure envelope.