Give the zip-bomb rejection test headroom against loaded runners

Compressing and inflating the 257-MiB zero buffer is CPU-bound and
exceeded vitest's 5 s default on a busy CI runner (5.4 s — the M15 push
ran CI and CD concurrently). Flaky tests are defects (ADR 0014): the
test gets an explicit 30 s timeout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fb2VzvcoBPHkjh8bZ6PzQn

apps/api/src/plugins/plugin-package.service.test.ts

@@ -150,11 +150,13 @@ describe('PluginPackageService.parse — each invalid class', () => {
     );
   });
 
+  // Compressing/inflating 257 MiB is CPU-bound and blew vitest's 5 s default
+  // on a busy CI runner (flaky = defect, ADR 0014) — give it real headroom.
   it('rejects a package that inflates beyond the unpacked limit', () => {
     const huge = new Uint8Array(257 * 1024 * 1024); // zeros compress tiny, inflate large
     expectReject(
       zip({ 'manifest.json': enc(JSON.stringify(codeManifest)), 'plugin.js': huge }),
       'plugin_too_large',
     );
-  });
+  }, 30_000);
 });