fix(mcp): harden validation, security, and MCP spec compliance

[mqasimca]

• SEC-001: enforce maxContentLength on newline-delimited JSON payloads
• SEC-004: sanitizeError now strips all http/https URLs via regex
• SEC-005: clamp limit params to max 200 across all list operations
• Fix parseToolCallParams/parseInitializeParams to return parse errors
• Add empty tool name validation before dispatch
• Use errors.Is(err, io.EOF) instead of direct comparison
• Use rune-safe truncation in cleanSnippet and body to prevent splitting multi-byte UTF-8 characters
• Require start_time/start_date with matching end field for events
• Validate end_time > start_time for timed events
• Validate RSVP status is yes/no/maybe with schema enum constraint
• Validate availability requires at least one participant
• Add IdempotentHint to destructive annotations (DELETE is idempotent)
• Add missing fields to update_event schema (start_date, end_date, conferencing_url, reminders) and executor
• Support updating contact emails and phone numbers
• Add hex_color to calendar list response for consistency
• Add signal.Stop and grant ID error logging in serve.go
• Fix tool count 37 -> 47 in mcp.go description