fix(mcp): rate-limit follow-ups from #831 review #838

Follow-ups from the reviews of #831 (gosqlx-mcp HTTP hardening, merged as 59f6022). None blocked the merge.

• Stream-cap rejections still spend rate-limit budget. A GET (SSE) request refused by the 4-streams-per-IP cap is still charged against the client's rate limit.
• Shared bucket without a trusted proxy. When neither GOSQLX_MCP_TRUSTED_PROXY_HEADER nor GOSQLX_MCP_TRUSTED_PROXY_HOPS is set behind a proxy, every client shares the proxy's address, so one bucket and one stream cap. Consider a startup warning or a docs note.
• Read-deadline errors are silently discarded. Errors from setting the 30s body read deadline are ignored.
• CF-Connecting-IP residual risk. A client reaching the Render origin directly can choose its rate-limit key. Trust the header only when the appended X-Forwarded-For hop is a Cloudflare IP, or require a secret header set by a Cloudflare Transform Rule.
• Minor: unparseable bodies get weight 0; a batched initialize can still get 429; confirm Render forwards CF-Connecting-IP.
• Docs: Server.Start() and Handler() should note they skip RateLimitMiddleware; docs/CHATGPT_APP.md should mention the shared limit.