Give each connect attempt 3.5 s so a resent SYN can land - #1436

Summary

#1376 raised the per-address connect attempt (autoSelectFamilyAttemptTimeout) from Node's 250 ms to 1 s for the SSRF-guarded agents. On Cloud the Telegram ETIMEDOUT errors did not stop; they moved to the new limit: 7 calls in 5 workspaces on 1 Nov failed after 1,019 to 1,162 ms. Linux resends a lost SYN after 1 s and again after 3 s, so a 1 s attempt ends just before the first resend can succeed.

Each attempt now gets 3.5 s, which covers both resends and still ends before the agent's 5 s socket timeout. A host whose IPv6 has no route fails that address at once, so the fallback speed for dual-stack hosts is unchanged in the Cloud containers.

Cloud and self-hosted behave the same.

Changes

• packages/backend/src/common/ssrf.util.ts: CONNECT_ATTEMPT_TIMEOUT_MS 1000 → 3500, comment with the evidence.
• packages/backend/src/common/ssrf.util.spec.ts: the value must be above 3 s and below the 5 s agent timeout.

Type

• Bug fix

Testing

• Added/updated unit tests (backend tests in CI)

Related Issues

Follow-up to #1376.