Rate limit the public docs search and MCP addresses #579

Summary

Confirm or add a rate limit on the public docs search and MCP addresses.

Context

/mcp and /api/docs/search need no credential. The MCP tools specification says servers MUST rate limit tool invocations (https://modelcontextprotocol.io/specification/latest/server/tools, Security Considerations). wrangler.jsonc at docs commit aeb5162 has no rate limit. A rule may exist in the Cloudflare dashboard, which I could not see.

Acceptance criteria

• A per-client limit applies to /mcp and /api/docs/search, or this issue records where the existing one is and closes.
• A limited client gets 429 with a Retry-After header, and marfa docs reports it as exit code 3, as the CLI does for a 429.
• src/AGENTS.md says where the limit is set.

Out of scope

• A limit on .md pages and llms.txt.

Notes

If the limit lives in the Cloudflare dashboard, write down the rule in the repository so a rebuild keeps it.