#321 Add rate limiting to the OAuth client registration endpoint

This PR adds rate limiting to the OAuth dynamic client registration endpoint, following the same shape Fortify uses:

// config/mcp.php
'limiters' => [
    'register' => 'mcp-register',
],

The default is 10 per minute per IP and gets registered in the service provider, so it applies without anyone needing to publish the config first. There are three ways to change it: define your own mcp-register limiter, point the config at a different limiter name, or set it to null to turn it off.

RateLimiter::for('mcp-register', fn ($request) => Limit::perMinute(60)->by($request->ip()));

Registration payloads also now cap redirect_uris at 5 entries of 2048 characters each, which every real client fits inside comfortably.