sync: put the revocation's timeout on the request itself

withTimeoutOrNull around the revoke bounded nothing. The call parks on a
socket read that neither coroutine cancellation nor Thread.interrupt can
break, and withContext returns only when its block does -- so the
deadline passed and we waited anyway, for the shared client's own
budget: 30s per resolved address, doubled by the authenticator's retry,
plus up to 120s of read timeout. Removing a homelab account off the VPN
sat there for minutes with nothing visibly happening. Only closing the
socket ends it, which is what callTimeout does.

The budget moves to AppPassword.revoke, where the "best effort, must not
block the removal" contract is already written down, and where it can be
enforced. Not on the shared client: callTimeout covers the whole
exchange including the body, and a multiget of a large list over a slow
link legitimately runs long. CalDavHttpTest pins that decision.

The destructive tail is now uncancellable. It spans four stores that
cannot share a transaction, and the caller is a viewModelScope tied to
the Settings destination, so a couple of back gestures used to kill it
mid-sequence. Only the DataStore writes can observe cancellation -- every
Room DAO here is blocking -- so the landing point was cadence.forget:
the app password already revoked while the row survives holding it, and
the account asking the user to sign in again for a credential we
invalidated ourselves. Further in, the tasks are gone and the row stays.
The tail is bounded and sub-second, so finishing it always beats
stopping inside it.

caldav/src/main/kotlin/de/jeanlucmakiola/caldav/AppPassword.kt

@@ -4,6 +4,9 @@ import okhttp3.HttpUrl
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import java.io.IOException
+import kotlin.time.Duration
+import kotlin.time.Duration.Companion.seconds
+import kotlin.time.toJavaDuration
 
 /**
  * Gives an app password back when the account is removed.
@@ -58,12 +61,33 @@ object AppPassword {
     }
 
     /**
+     * ⚠️ The budget is enforced here because nothing above can enforce it.
+     * `execute()` parks on a socket read, which no coroutine cancellation and no
+     * `Thread.interrupt` can break — only closing the socket does, which is what
+     * `callTimeout` does. Wrapping this call in `withTimeoutOrNull` instead
+     * returns only once the read has finished anyway, so the caller waits out
+     * the shared client's own budget: 30s *per resolved address*, doubled by the
+     * authenticator's retry, plus up to 120s of read timeout. Minutes, for a
+     * step whose own doc says it must not block the removal.
+     *
+     * Not set on the shared client on purpose: `callTimeout` bounds the whole
+     * exchange including the body, and a multiget of a large list over a slow
+     * link legitimately runs long.
+     *
      * @return true when the server confirmed the revocation. False means the
      *   credential may still exist server-side — the caller carries on regardless.
      */
-    fun revoke(httpClient: OkHttpClient, principal: HttpUrl): Boolean = try {
+    fun revoke(
+        httpClient: OkHttpClient,
+        principal: HttpUrl,
+        timeout: Duration = REVOCATION_TIMEOUT,
+    ): Boolean = try {
         val url = ocsRootFor(principal).newBuilder().addPathSegments(PATH).build()
-        httpClient.newCall(
+        httpClient.newBuilder()
+            // Shares the pool and dispatcher, so this costs nothing.
+            .callTimeout(timeout.toJavaDuration())
+            .build()
+            .newCall(
             Request.Builder()
                 .url(url)
                 .delete()
@@ -73,10 +97,14 @@ object AppPassword {
                 .header("OCS-APIRequest", "true")
                 .header("Accept", "application/json")
                 .build(),
-        ).execute().use { it.isSuccessful }
+            ).execute().use { it.isSuccessful }
     } catch (_: IOException) {
+        // callTimeout throws InterruptedIOException, which lands here.
         false
     } catch (_: IllegalArgumentException) {
         false
     }
+
+    /** What a best-effort courtesy call is worth waiting for. */
+    val REVOCATION_TIMEOUT: Duration = 5.seconds
 }

caldav/src/test/kotlin/de/jeanlucmakiola/caldav/AppPasswordTest.kt

@@ -5,9 +5,13 @@ import okhttp3.HttpUrl.Companion.toHttpUrl
 import okhttp3.OkHttpClient
 import okhttp3.mockwebserver.MockResponse
 import okhttp3.mockwebserver.MockWebServer
+import okhttp3.mockwebserver.SocketPolicy
 import org.junit.After
 import org.junit.Before
 import org.junit.Test
+import kotlin.time.Duration.Companion.milliseconds
+import kotlin.time.Duration.Companion.nanoseconds
+import kotlin.time.Duration.Companion.seconds
 
 class AppPasswordTest {
 
@@ -38,6 +42,30 @@ class AppPasswordTest {
             .isEqualTo("https://baikal.example.com/")
     }
 
+    @Test fun `a server that never answers does not hold the removal`() {
+        // Accepts the connection and says nothing — the off-VPN homelab shape.
+        server.enqueue(MockResponse().setSocketPolicy(SocketPolicy.NO_RESPONSE))
+
+        val startedAt = System.nanoTime()
+        val revoked = AppPassword.revoke(
+            httpClient,
+            server.url("/remote.php/dav/principals/users/alice/"),
+            timeout = 200.milliseconds,
+        )
+        val elapsed = (System.nanoTime() - startedAt).nanoseconds
+
+        // ⚠️ The budget has to live on the call. execute() parks on a socket read
+        // that neither coroutine cancellation nor Thread.interrupt can break, so
+        // a timeout imposed from outside returns only once the read has finished
+        // anyway — after the shared client's own minutes-long budget.
+        assertThat(revoked).isFalse()
+        assertThat(elapsed).isLessThan(2.seconds)
+    }
+
+    @Test fun `the default budget is what the removal is willing to wait`() {
+        assertThat(AppPassword.REVOCATION_TIMEOUT).isEqualTo(5.seconds)
+    }
+
     @Test fun `the revocation is a DELETE with the OCS header`() {
         server.enqueue(MockResponse().setResponseCode(200))
 

caldav/src/test/kotlin/de/jeanlucmakiola/caldav/CalDavHttpTest.kt

@@ -202,6 +202,14 @@ class CalDavHttpTest {
         .header("WWW-Authenticate", "$scheme realm=\"dav\"")
         .build()
 
+    @Test
+    fun `the shared client has no call timeout`() {
+        // ⚠️ Deliberate. A callTimeout bounds the whole exchange including the
+        // body, and a multiget of a large list over a slow link legitimately runs
+        // long. The one call that needs a budget sets its own.
+        assertThat(CalDavHttp.anonymous("Agendula").callTimeoutMillis).isEqualTo(0)
+    }
+
     @Test
     fun `derived clients share one connection pool`() {
         // A fresh OkHttpClient per probe gives each its own pool and dispatcher