Added

• Request body size limits and timeouts for MCP HTTP requests.
• PCLI2 command timeouts and max output size enforcement.

Changed

• Stricter JSON-RPC request validation for required fields and types.
• Tool schema construction refactored for consistency and reuse.