fix: use async CLI Apps catalog refresh

Replace the manual thread-based catalog refresh with an asyncio task and async HTTP catalog fetches so the Settings route stays within the async WebUI model.

tests/channels/test_websocket_http_routes.py

@@ -5,8 +5,8 @@ import functools
 import json
 import random
 import socket
-import threading
 import time
+from contextlib import suppress
 from pathlib import Path
 from typing import Any
 from unittest.mock import AsyncMock, MagicMock
@@ -484,12 +484,13 @@ async def test_cli_apps_catalog_does_not_block_other_webui_http_routes(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    entered = threading.Event()
-    release = threading.Event()
+    entered = asyncio.Event()
+    release = asyncio.Event()
 
-    def slow_payload() -> dict[str, Any]:
+    async def slow_payload() -> dict[str, Any]:
         entered.set()
-        release.wait(2.0)
+        with suppress(asyncio.TimeoutError):
+            await asyncio.wait_for(release.wait(), 2.0)
         return {"apps": [], "installed_count": 0, "catalog_updated_at": None}
 
     monkeypatch.setattr("nanobot.webui.settings_routes.cli_apps_payload", slow_payload)
@@ -505,7 +506,7 @@ async def test_cli_apps_catalog_does_not_block_other_webui_http_routes(
         catalog_task = asyncio.create_task(
             _http_get("http://127.0.0.1:29935/api/settings/cli-apps", headers=auth)
         )
-        assert await asyncio.to_thread(entered.wait, 2.0)
+        assert await asyncio.wait_for(entered.wait(), 2.0)
         assert time.perf_counter() - started < 1.0
 
         workspaces_started = time.perf_counter()