fix(mcp): hardening gaps: Mongo maxTimeMS and response size, list sizes, session limits, a few unhandled errors #1776

Smaller findings from the MCP review:

• Mongo timeout (`McpMongoService._withSession`): the Dart future is dropped and the session closed, but no `maxTimeMS` is sent, so a heavy `$regex` or `$expr` may keep running server-side. The response is capped per field (4096 chars) but not in total.
• `McpMongoGuard.maxKeys` counts map keys only; a huge `$in` list is not limited.
• `McpSocketHost`: after the handshake there is no cap on a line's length or on the number of concurrent sessions; an unterminated line buffers without bound.
• `McpAccessStore.setReadable` reads, changes and writes the list without a lock; two quick toggles can lose one.
• `McpServerController._persist` is `unawaited` without error handling; a failed write goes only to the zone handler.
• `McpServerController._start`: if `host.start()` throws after binding the socket, `_host` stays null and the host keeps listening with a token nobody has.
• `McpQueryService`: a non-`McpToolException` thrown in a body is redacted by `_guarded` without the connection row, so the connection's own secrets are not masked.

Found in the MCP review.