docs(spec): login timeouts and owner-unreachable wording

docs/superpowers/specs/2026-09-25-claude-code-relogin-design.md

@@ -87,8 +87,8 @@ state, so a code only works with the process that printed its link. `claude auth
     waiter's `/stop` doesn't kill the flow for everyone else. It stores the task.
   - Every caller awaits the stored task with `WaitAsync(ct)`. A cancelled caller only stops waiting.
   - When the task completes, the slot clears. The next expired-session request starts a new flow.
-- The flow is abandoned when the owner doesn't answer: the prompt timeout (10 min in `TelegramUi`) returns null,
-  the flow fails, and every waiter fails.
+- The flow is abandoned when the owner doesn't answer: `ClaudeLoginOptions.CodeTimeout` (10 min) bounds each code
+  prompt whatever the UI does, so the flow fails and every waiter fails. Resolving `LoginUi` is bounded to 30 s.
 
 ### 4. The login channel — `ClaudeCodeProviderOptions.LoginUi`
 
@@ -100,14 +100,16 @@ state, so a code only works with the process that printed its link. `claude auth
   - `Report`: `ui.Notify(message, NotifyKind.Warning)`.
 - After success the owner gets `Notify("Claude Code login complete ✓")`. After failure:
   `Notify("Claude Code login failed: <reason>", Error)`.
-- **Headless hosts** (`LoginUi` is null or returns null): no flow runs. The request fails with
+- **Headless hosts** (`LoginUi` is null): no flow runs. The request fails with
   `[auth] Claude Code session expired; run "claude auth login" on the host (or /claude-code-login from a chat UI)`.
 - **Telegram host:** `Program.cs` registers a `ClaudeCodeProviderOptions` singleton. `ActivatorUtilities` hands it
   to the extension's constructor. Its `LoginUi` resolves lazily through the service provider:
   `ct => (await sp.GetRequiredService<ChatRegistry>().GetAsync(options.AllowedUserIds[0], ct)).Ui`. This
-  resolves at call time to avoid a construction cycle. In a private chat, the chat id is the user id. If sending
-  fails (the owner never started the bot), `InputAsync` returns null, the flow fails, and the error reads
-  `the owner could not be reached; the first allowed user must start a chat with the bot`.
+  resolves at call time to avoid a construction cycle. In a private chat, the chat id is the user id.
+- **Owner unreachable:** if `LoginUi` returns null (or doesn't resolve within 30 s), the flow fails with
+  `the owner could not be reached; the first allowed user must start a chat with the bot`. If the owner's chat
+  resolves but sending fails (the owner never started the bot), `InputAsync` returns null and the flow fails with
+  `no code was entered`.
 
 ### 5. Provider integration — `ClaudeCodeApi`
 
@@ -144,10 +146,11 @@ state, so a code only works with the process that printed its link. `claude auth
 |---|---|
 | 401 / expired, login UI available, owner pastes a valid code | request replays and succeeds |
 | owner pastes wrong code | new link, up to 3 attempts |
-| owner doesn't answer in 10 min | every waiting request fails `[auth] Claude Code login failed: no code was entered` |
+| owner doesn't answer in 10 min (`CodeTimeout`) | every waiting request fails `[auth] Claude Code login failed: no code was entered` |
 | requesting user sends `/stop` while waiting | that request aborts; the flow continues for the others |
 | no login UI (headless) | `[auth] Claude Code session expired; run "claude auth login"…` |
-| owner unreachable | `[auth] Claude Code login failed: the owner could not be reached…` |
+| `LoginUi` returns null | `[auth] Claude Code login failed: the owner could not be reached…` |
+| owner never started the bot | `[auth] Claude Code login failed: no code was entered` |
 | expired again right after login | attempt 2's error is published, no loop |
 | `apiKeySource != none` / denied env var | unchanged `[auth]` failure, no login |