fix: harden MCP server auth, CORS, and request size limits - #607

Summary

• (Auth): Log warning when no auth configured; reject requests when bearer auth has no validate function
• (CORS): Match request Origin against full origins array instead of only origins[0]; require explicit origins when CORS enabled (no "*" default)
• (Size limit): Add 1MB request body size limit with Content-Length header fast-path and body text length fallback

Test plan

• Bearer auth without validate function rejects all requests (401)
• Bearer auth without Authorization header rejects (401)
• Bearer auth with valid token accepts request (200)
• Bearer auth with invalid token rejects (401)
• Request with Content-Length > 1MB rejected (413 fast path)
• Request with body > 1MB rejected even without Content-Length (413 fallback)
• Request within 1MB limit accepted (200)
• CORS headers set when request Origin matches configured origins
• No CORS headers when request Origin does not match
• No CORS headers when no origins configured
• No CORS headers when CORS is disabled
• CORS headers included on POST responses when Origin matches
• MCP server logs warning on startup when auth is not configured
• All 18 tests passing