Add default timeout to all API requests

[janfryauf]

No request passes timeout=, so a request that connects and then stops responding blocks forever. In Home Assistant this freezes polling: update_data() never returns, the coordinator never schedules the next refresh, and entities keep their last values until the integration is reloaded. See klejejs/ha-thermia-heat-pump-integration#147 (also #118 and #126 there).

Changes:

• ThermiaSession, a requests.Session subclass that applies DEFAULT_REQUEST_TIMEOUT = (10, 30) (connect, read, in seconds) to every request unless the caller passes its own timeout. This covers all current call sites and any new ones.
• Retry(total=20) is now Retry(total=5). urllib3 also retries GET read timeouts, so with 20 retries one hung request could still block for about 32 minutes (21 attempts of 30 s plus backoff). With 5 the worst case is about 3 minutes. POSTs (login, register writes) are retried only on connection failures, where the server never received the request, and never on read timeouts or 5xx responses. So a write is never sent twice.

Trade-off: a network outage while logging in now fails after a few seconds of retries. Before, it kept retrying for up to about 21 minutes. klejejs/ha-thermia-heat-pump-integration#153 makes Home Assistant retry the setup in that case.

Test: setup_thermia_and_perform_basic_tests now asserts that every request carries the default timeout. Before this change, all 16 requests in each model test had timeout=None.

Also checked locally against a socket that accepts connections and never answers, with the timeout shortened to 1 s: the old session was still blocked after 15 s, and the new one raised after 9 s (6 attempts plus 3 s backoff). A live login and poll against the Thermia API (iTec IQ) still work.

Related: #61 also adds a timeout, but it also retries non-idempotent requests (the login POST, the auth-code exchange and register writes) and makes __set_register_value raise on non-200 responses. This PR is only the timeout and retry-count change. Both edit the same lines in ThermiaAPI.__init__, so only one of them can be merged as is.