Fix MCP transport, path boundary, and rate-limit hardening issues

[Widthdom]

Summary

• Harden HTTP MCP auth, queue accounting, health JSON, SSE fan-out, and SSE frame bounds.
• Tighten MCP tool filtering, string-list validation diagnostics, rate limiter bucket cardinality, and path/URI boundary handling.
• Synchronize status-contract documentation and add changelog fragments for each handled issue.
• Merged the latest origin/main before pushing.

Validation

• dotnet build CodeIndex.sln
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter "FullyQualifiedName~HttpMcpTransportTests|FullyQualifiedName~McpServerTests|FullyQualifiedName~RateLimiterTests|FullyQualifiedName~DbPathResolverTests|FullyQualifiedName~DocumentationStatusContractTests"
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net9.0 --filter "FullyQualifiedName~HttpMcpTransportTests|FullyQualifiedName~McpServerTests|FullyQualifiedName~RateLimiterTests|FullyQualifiedName~DbPathResolverTests|FullyQualifiedName~DocumentationStatusContractTests"
• dotnet run --project tools/CodeIndex.Changelog -- check
• dotnet test tests/CodeIndex.Tests/CodeIndex.Tests.csproj --framework net8.0 --filter FullyQualifiedName~DocumentationStatusContractTests
• dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll status --check --json
• codex exec --ephemeral --ignore-rules --sandbox read-only ... adversarial review; one status-contract path mismatch was found and fixed in 268213e6c.

Documentation And Changelog

• Updated README.md, DEVELOPER_GUIDE.md, USER_GUIDE.md, and AGENT_GUIDE.md where behavior or status-contract documentation changed.
• Added changelog fragments:
  • changelog.d/unreleased/3752.fixed.md
  • changelog.d/unreleased/3753.fixed.md
  • changelog.d/unreleased/3756.fixed.md
  • changelog.d/unreleased/3780.fixed.md
  • changelog.d/unreleased/3789.fixed.md
  • changelog.d/unreleased/3815.fixed.md
  • changelog.d/unreleased/3829.fixed.md

Follow-up Candidates

None.

Fixes #3815
Fixes #3756
Fixes #3829
Fixes #3780
Fixes #3752
Fixes #3753
Fixes #3789