Add 5-second timeout when reading error response body

Prevents hanging in edge cases where server sends error response but
doesn't end the request. Linked CancellationTokenSource ensures the
original cancellation token is still honored.

Co-authored-by: stephentoub <2642209+stephentoub@users.noreply.github.com>

Author: Copilot

src/Common/HttpResponseMessageExtensions.cs

@@ -24,12 +24,15 @@ public static async Task EnsureSuccessStatusCodeWithResponseBodyAsync(this HttpR
             string? responseBody = null;
             try
             {
-                responseBody = await response.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
+                // Add a timeout to prevent hanging if the server sends an error response but doesn't end the request.
+                using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                cts.CancelAfter(TimeSpan.FromSeconds(5));
+                responseBody = await response.Content.ReadAsStringAsync(cts.Token).ConfigureAwait(false);
             }
-            catch (Exception ex) when (ex is not OperationCanceledException)
+            catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
             {
-                // Ignore errors reading the response body (e.g., stream closed) - we'll throw without it.
-                // Allow cancellation exceptions to propagate.
+                // Ignore errors reading the response body (e.g., stream closed, timeout) - we'll throw without it.
+                // Allow cancellation exceptions to propagate only if the original token was cancelled.
             }
 
             throw CreateHttpRequestException(response, responseBody);