fix: clamp oversized terminal timeout

backend/cmd/installer/wizard/models/server_settings_form.go

@@ -289,10 +289,10 @@ func (m *ServerSettingsFormModel) GetCurrentConfiguration() string {
 
 	if terminalTimeout := cfg.TerminalToolTimeout.Value; terminalTimeout != "" {
 		terminalTimeout = m.GetStyles().Info.Render(terminalTimeout + "s")
-		sections = append(sections, fmt.Sprintf("• %s: %s", locale.ServerSettingsTerminalToolTimeoutHint, terminalTimeout))
+		sections = append(sections, fmt.Sprintf("• %s: %s", locale.ServerSettingsTerminalToolTimeoutHint, terminalTimeout))
 	} else if terminalTimeout := cfg.TerminalToolTimeout.Default; terminalTimeout != "" {
 		terminalTimeout = m.GetStyles().Muted.Render(terminalTimeout + "s")
-		sections = append(sections, fmt.Sprintf("• %s: %s", locale.ServerSettingsTerminalToolTimeoutHint, terminalTimeout))
+		sections = append(sections, fmt.Sprintf("• %s: %s", locale.ServerSettingsTerminalToolTimeoutHint, terminalTimeout))
 	}
 
 	if externalSSLCAPath := cfg.ExternalSSLCAPath.Value; externalSSLCAPath != "" {

backend/pkg/tools/terminal.go

@@ -83,7 +83,7 @@ func (t *terminal) normalizeExecTimeout(timeout time.Duration) time.Duration {
 	case timeout > 0 && timeout <= maxRuntimeExecCommandTimeout:
 		return timeout
 	case timeout > maxRuntimeExecCommandTimeout:
-		return t.configuredExecTimeout()
+		return maxRuntimeExecCommandTimeout
 	default:
 		return t.configuredExecTimeout()
 	}

backend/pkg/tools/terminal_test.go

@@ -231,10 +231,10 @@ func TestNormalizeExecTimeout(t *testing.T) {
 			want:       10 * time.Minute,
 		},
 		{
-			name:       "too large explicit timeout falls back to configured default",
+			name:       "too large explicit timeout clamps to max runtime timeout",
 			configured: 10 * time.Minute,
 			requested:  maxRuntimeExecCommandTimeout + time.Second,
-			want:       10 * time.Minute,
+			want:       maxRuntimeExecCommandTimeout,
 		},
 		{
 			name:       "configured zero keeps timeout disabled",
@@ -242,6 +242,12 @@ func TestNormalizeExecTimeout(t *testing.T) {
 			requested:  0,
 			want:       0,
 		},
+		{
+			name:       "configured zero does not disable oversized explicit timeout limit",
+			configured: 0,
+			requested:  maxRuntimeExecCommandTimeout + time.Second,
+			want:       maxRuntimeExecCommandTimeout,
+		},
 	}
 
 	for _, tt := range tests {