[SECURITY] E2-6: MCP batch_create_sessions and create_pipeline have unbounded arrays

[OneStepAt4time]

Finding

ID: MCP-2, MCP-3 | Severity: 🟠 MEDIUM

batch_create_sessions.sessions and create_pipeline.steps accept arrays with no max length. An agent could submit 1,000+ sessions in one call.

Fix Required

Add .max(50) constraint to both array schemas in src/mcp-server.ts.

Files: src/mcp-server.ts

Acceptance Criteria

A batch_create_sessions call with 51 items returns a validation error.

Milestone

M-E2: Identity & Access Control