ai: apply changes for #876 (1 review thread)

Addresses:
  - #3636022364 at src/databricks/sql/auth/oauth.py:162

Signed-off-by: peco-engineer-bot[bot] <peco-engineer-bot[bot]@users.noreply.github.com>

Author: peco-engineer-bot[bot]

src/databricks/sql/auth/oauth.py

@@ -160,6 +160,14 @@ def __get_authorization_code(self, client, auth_url, scope, state, challenge):
                     # Bound how long we wait for the browser redirect callback so
                     # that a headless environment (no browser to complete the
                     # flow) fails with a clear error instead of hanging forever.
+                    # NOTE: httpd.timeout bounds only the wait to ACCEPT an
+                    # incoming connection (it is the select() timeout used by
+                    # handle_request). It does not bound the subsequent read of
+                    # the HTTP request by the handler, so a client that connects
+                    # but never completes the request line could still block. On
+                    # this short-lived loopback server that residual gap is
+                    # acceptable; the headless "no connection ever arrives" case
+                    # (issue #458) is fully covered.
                     httpd.timeout = self._redirect_callback_timeout_seconds
 
                     # HTTPServer.handle_request() returns normally (via