refactor: streaming, security hardening, and MCP removal

Major overhaul of server architecture and security posture:

- Streaming: Unified all I/O through PIPESIZE (8192-byte) buffers.
  POST bodies stream via MpscReader through the save pipeline. GET
  content streams from disk via decompression to client. Removed
  save_item_with_reader, get_item_content_info, ChannelReader.
  413 responses keep partial items (nonfatal by design).

- Security: XSS protection in all HTML pages via html_escape crate.
  Security headers middleware (nosniff, frame deny, referrer policy).
  CORS tightened to explicit headers. Input validation for tags
  (256 chars), metadata (128/4096), pagination (10k cap). Config
  file reads use from_utf8_lossy. Generic error messages in HTML.
  Diff endpoint has 10 MB per-item cap. max_body_size config option.

- Panics eliminated: Path unwraps → proper error propagation.
  Mutex unwraps → map_err (registries) / expect with message (local).

- MCP removed: Deleted all MCP code, rmcp dependency, mcp feature.

- Docs: Updated README, DESIGN, AGENTS to reflect all changes.

src/services/status_service.rs

@@ -74,7 +74,7 @@ impl StatusService {
         settings: &Settings,
         data_path: PathBuf,
         db_path: PathBuf,
-    ) -> StatusInfo {
+    ) -> anyhow::Result<StatusInfo> {
         // Get meta plugins directly from config
         let meta_plugin_types: Vec<MetaPluginType> =
             crate::modes::common::settings_meta_plugin_types(cmd, settings);
@@ -91,10 +91,10 @@ impl StatusService {
             db_path,
             &meta_plugin_types,
             enabled_compression_type,
-        );
+        )?;
 
         // Add detailed filter plugins information
-        let filter_plugins_map = get_available_filter_plugins();
+        let filter_plugins_map = get_available_filter_plugins()?;
         let mut filter_plugins_info = Vec::new();
 
         for (name, creator) in filter_plugins_map {
@@ -114,7 +114,7 @@ impl StatusService {
         // Add configured meta plugins information
         status_info.configured_meta_plugins = settings.meta_plugins.clone();
 
-        status_info
+        Ok(status_info)
     }
 }