Address the Codex review finding on #199: the ledger deadline only
disconnects the tracked source, which kills the script shell but can
orphan its kdialog grandchild, leaving the old password dialog open and
allowing a second dialog after reopening. The dialog phase now runs
under its own timeout just below the QML deadline (870s + 5s kill
against the 900s ledger deadline), so a timed-out prompt exits through
the existing clean-cancellation path before the disconnect, for both
setApiKey and descriptor secret prompts. Surface checks enforce the
dialog bound; the usage guide wording now matches the self-closing
prompt.