Decouple CancellationToken from HTTP request for streaming support

[rido-min]

Summary

• Decouples the CancellationToken passed to bot handlers from the incoming HTTP request's HttpContext.RequestAborted token, which fires when Teams closes the connection (~15s) — before streaming handlers finish their work.
• Adds BotApplicationOptions.ProcessActivityTimeout (default: 5 minutes) as a configurable timeout that replaces the HTTP-bound token.
• Handles OperationCanceledException gracefully when the timeout fires, logging a warning instead of throwing BotHandlerException.

Problem

Streaming bots send responses via the Bot Connector API (ConversationClient.SendActivityAsync), not through the original HTTP response. The handler legitimately outlives the HTTP request. Previously, the HTTP disconnection would cancel in-flight LLM streaming calls, causing TaskCanceledException → BotHandlerException → 500 errors.

Design document

See docs/design-decouple-cancellation-token.md for the full design proposal, alternatives considered, and impact analysis.

Test plan

• Verify StreamingBot sample streams full LLM responses without TaskCanceledException
• Verify non-streaming bots (e.g. CoreBot, EchoBot) are unaffected by the 5-minute default
• Verify ProcessActivityTimeout can be configured to a custom value
• Verify timeout fires and logs warning (not exception) when a handler exceeds the configured duration
• Verify Debugger.IsAttached still bypasses the timeout with CancellationToken.None

🤖 Generated with Claude Code