fix(web): clamp dashboard session search limit parameter

[aydnOktay]

Summary

This PR clamps the limit query parameter on GET /api/sessions/search in the web dashboard so invalid or excessive values cannot overload SQLite FTS queries.

Problem

The dashboard session search endpoint forwarded limit directly to SessionDB.search_messages(). Callers could pass limit=0, negative values, or very large numbers (e.g. 9999), which is unnecessary load for a UI search endpoint and produces surprising behavior.

Solution

• Add _clamp_session_search_limit() with default 20, minimum 1, maximum 100.
• Apply it at the start of search_sessions() before opening the DB connection.

Tests

• Unit tests for the clamp helper (invalid, zero, excessive values).
• Endpoint test verifying the clamped limit is passed through to SessionDB.search_messages().

4 tests passed locally.

Notes

• Focused change in hermes_cli/web_server.py only; no workflow or unrelated file changes.
• Complements (but does not duplicate) lower-level SessionDB pagination hardening if submitted separately.

[alt-glitch]

Related to #32564 and #35308 (same author, same clamping pattern applied to hermes_state.py). This PR is the web_server.py / dashboard variant.

[teknium1]

Thanks for the focused dashboard hardening. This is an automated hermes-sweeper review; current main already provides the requested behavior, so this PR is superseded.

• hermes_cli/web_server.py:4210 clamps the route limit to the same positive 1..100 range before opening search work.
• hermes_cli/web_server.py:4303 and hermes_cli/web_server.py:4331-4332 apply that bounded value to the ID search and to the bounded FTS over-fetch.
• The additional stream-tail change is also covered on current main by tests/gateway/test_stream_consumer.py:572-600, which verifies failed edits deliver only the unsent tail.
• The member note linking Clamp session DB pagination limits for search and listing APIs #32564 and fix(state): clamp session DB pagination limits for search and listing #35308 was considered; no remaining behavior from this PR needs to be added separately.