fixes

apps/api/internal/security/http_client.go

@@ -26,9 +26,14 @@ func SafeHTTPClientPolicy(timeout time.Duration, policy DialPolicy) *http.Client
 	if timeout <= 0 {
 		timeout = 30 * time.Second
 	}
+	tr := SafeHTTPTransportPolicy(policy)
+	// Match header wait to overall timeout. A fixed 30s ResponseHeaderTimeout
+	// aborts OpenAI-compatible LLM calls that withhold headers until generation
+	// finishes (reasoning models often take 60–180s).
+	tr.ResponseHeaderTimeout = timeout
 	return &http.Client{
 		Timeout:   timeout,
-		Transport: SafeHTTPTransportPolicy(policy),
+		Transport: tr,
 	}
 }