docs: update TODO and add BOOTSTRAP mistake #13 for API retry regression

TODO__Agents.md:
- Added the two additional fixes from the review pass to the PATCH/DELETE
  retry hardening entry: default timeout 60s→20s, and DELETE missing
  ae_auth_error banner on 401/403.

BOOTSTRAP__AI_Agent_Quickstart.md:
- Added mistake #13: breaking the API retry loop by returning errors from
  the TypeError/AbortError block instead of throwing them. Documents the
  Jan 2026 regression (commit a10accfaa), the three retry classes that must
  be preserved, and a quick verification method.
- Filled the gap at item #7 (was missing, causing off-by-one numbering
  from item 8 onward). Items renumbered 8-14 → 7-13.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -233,6 +233,13 @@ including timeout abort separation and capped retry backoff.
 - ✅ No regression for 400/401/403/422 fail-fast behavior.
 - ✅ `npx svelte-check` clean, API-focused Playwright tests remained green during rollout.
 
+**Additional fixes found during review pass (2026-05-21, commit ea765d8ad):**
+- PATCH + DELETE: default timeout lowered from 60s → 20s to match GET/POST. No callers set
+  explicit timeouts; 60s × 5 retries = 5-minute worst case before giving up.
+- DELETE: added `ae_auth_error` import and session-expired banner on 401/403. All other
+  files (GET/POST/PATCH) trigger the banner; DELETE was missing it, causing stale-session
+  deletes to silently return false with no user-visible feedback.
+
 ---
 
 ### [Testing] V3 API performance probe (basic stress rounds)