Document request timeouts — default is no timeout

From the SDK review 2026-09-15.

Evidence: _request_timeout defaults to None (goadserver/rest.py:162), so a hanging server blocks the caller forever. The option exists per call — it is just not documented.

Fix: add a _request_timeout example to the README plus one sentence discouraging production use without a timeout. (Same gap in the Go/PHP/JS SDKs, with issues there.)