A test pins MCP `limits`: an unknown key is refused, out-of-bounds values are refused, and `""` restores the default #7149

src/http/mcp/tools/limits.ts refuses no_such_limit, and no test names it. Each case calls the tool through /mcp with a real token, as test/mcp.test.ts does.

Done:

• [ ] A new test: a forge admin lists every limit with value, default and bounds.
• [ ] Setting a known key plans first, and dryRun: false with an admin-scope token applies it. value: "" then restores the default.
• [ ] An unknown key is no_such_limit and names the key. A value outside the bounds is refused, and the limit is unchanged.
• [ ] A non-admin is refused.

Files: test/mcp-limits.test.ts

If the test finds the behaviour wrong, fix the tool in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.