fix: bound discovery time and response size

[TheGreatAxios]

A tenant member could point discovery at a server that streams forever, so the route never returned, or sends one huge SSE frame (64 MB cost about 1.6 GB of RSS). The client also never cancelled the body after reading its frame. At run time, mcpTools and the sidecar bundle sent initialize and tools/call with no bound and ignored the tool call's abort signal, so a stalling server hung the agent's tool call.

Changes

• McpClientOptions gains timeoutMs. It covers the request and reading its body. Discovery (discoverMcpServer, and so the hub route) uses 30 seconds; discoverMcpServer takes timeoutMs to override it.
• McpClientOptions also gains signal, which cancels the request and body read.
• mcpTools and mcpServers take a timeoutMs option (60 seconds by default, DEFAULT_TIMEOUT_MS) for initialize and tools/call, and pass each tool call's abort signal to tools/call.
• A JSON body or SSE frame (and the pending SSE buffer) over 4 MiB is refused with an McpError.
• The body reader is cancelled on overflow, on timeout, on a non-2xx and once the matching frame is read.
• Tests (each fails before the fix): an endless keep-alive stream, a stalled server, an oversized frame, an oversized JSON body, cancellation after the matching frame, a stalled server through discoverMcpServer, and a stalling tools/call timing out and being cancelled through both mcpTools and mcpServers.
• README documents timeoutMs, signal, the run-time default, the cap and the discovery timeout.

Checks

bun run check, bun run build and the Node pack smoke pass locally.

Closes CL-9452