Add timeout and response size limit for HTTP fetches

[campoy]

Summary

• Replace the default http.Get (no timeout) with a package-level http.Client set to a 10-second timeout, preventing the process from hanging on slow or unresponsive servers.
• Wrap the response body with io.LimitReader at 10 MiB so a large response cannot exhaust memory.
• Add embedmd/content_test.go with three tests using httptest.NewServer:
  • timeout: server hangs after sending headers; expect an error within the short deadline.
  • size limit: server returns more than 10 MiB; expect exactly 10 MiB back with no error.
  • 404: server returns Not Found; expect a non-nil error.

Test plan

• TestFetchHTTPTimeout — process returns an error when the server stalls
• TestFetchHTTPSizeLimit — response is capped at exactly 10 MiB
• TestFetchHTTPNotFound — non-200 status returns an error
• All existing tests continue to pass (go test ./...)

Closes #81