docs: security.mdx claims url({maxQueryLength}) / url({maxPairs}) but url() accepts no options #240

Problem

src/content/docs/concepts/security.mdx (Resource Bounding table, lines ~205–206) documents:

| Query string length | 8,192 bytes | url({maxQueryLength}) |
| Query key-value pairs | 256 | url({maxPairs}) |

Both entries are inaccurate against ergo main (d900880):

1. Wrong option name. The parser option is maxLength (see lib/query.js JSDoc @param {number} [options.maxLength=8192]), not maxQueryLength.
2. Not configurable via url(). The url() factory (http/url.js) takes no parameters and calls queryParse(raw.slice(qIdx + 1)) with no options object. The maxPairs: 256 / maxLength: 8192 bounds are hardcoded parser defaults and cannot currently be overridden through url().

This violates DECISIONS.md §1 Content accuracy (site docs must match the current state of the library repos).

Evidence

# ergo http/url.js (main)
export default () => {
  const inner = function urlMiddleware({url} = {}) {
    ...
    query: queryParse(raw.slice(qIdx + 1)),   // no options forwarded

# ergo lib/query.js (main)
 * @param {number} [options.maxPairs=256]
 * @param {number} [options.maxLength=8192]

Proposed fix

Either:

• (A) Correct the Configuration column to reflect reality — the query bounds are non-configurable parser defaults (remove the url({...}) configuration claim, or mark as "not configurable"), and rename maxQueryLength → maxLength if/when a config surface is added; or
• (B) If ergo intends to make url() forward parser options, track that as an ergo feature request first, then document the real option name (maxLength).

Acceptance criteria

• security.mdx Resource Bounding table entries for query length / query pairs match the actual ergo url() / lib/query.js API surface
• Option name matches lib/query.js JSDoc (maxLength)
• Verified against ergo main at time of fix

Notes

Discovered during Lead Architect review of #237 (which corrected the same maxQueryLength → maxLength naming in url.mdx). Out of scope for #237; logged separately to avoid scope creep.