Enforce HTTP MCP limit caps

[Widthdom]

Summary

• Enforce hard maximums for CDIDX_MCP_HTTP_MAX_REQUEST_BYTES and CDIDX_MCP_HTTP_MAX_QUEUE_DEPTH before the HTTP listener starts.
• Return CLI usage errors for oversized HTTP MCP limit configuration and document accepted ranges.
• Add HTTP transport and CLI regression coverage, including positive integer overflow environment values.

Validation

• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~HttpMcpTransportTests" -p:UseSharedCompilation=false
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --filter "FullyQualifiedName~ProgramCliTests.Mcp_HttpOversizedLimitEnvironmentReturnsUsageError" -p:UseSharedCompilation=false
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet format CodeIndex.sln --verify-no-changes
• dotnet build CodeIndex.sln -c Release -p:UseSharedCompilation=false
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll . --json
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• Adversarial review: no blocking/actionable issues found.

Full dotnet test CodeIndex.sln -c Release -p:UseSharedCompilation=false --no-build passed on the immediately preceding latest-base run; after origin/main advanced again, the branch was cherry-picked onto the current origin/main and the targeted tests/build/checks above were rerun.

Changelog

• changelog.d/unreleased/3157-3227.fixed.md

Fixes #3157
Fixes #3227