docs(mcp): document connection timeout and URL scheme validation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/plugins/bundles.md

@@ -137,7 +137,8 @@ MCP servers can use stdio or HTTP transport:
         "transport": "streamable-http",
         "headers": {
           "Authorization": "Bearer ${MY_SECRET_TOKEN}"
-        }
+        },
+        "connectionTimeoutMs": 30000
       }
     }
   }
@@ -145,10 +146,13 @@ MCP servers can use stdio or HTTP transport:
 ```
 
 - `transport` must be `"streamable-http"` or `"sse"`; there is no auto-detection
+- only `http:` and `https:` URL schemes are allowed
 - `headers` values support `${ENV_VAR}` interpolation
 - a server entry with both `command` and `url` is rejected
 - URL credentials (userinfo and query params) are redacted from tool
   descriptions and logs
+- `connectionTimeoutMs` overrides the default 30-second connection timeout for
+  both stdio and HTTP transports
 
 ##### Tool naming