feat(mcp): add render.rs content policy (text paging, pattern filter, blob spill)

Single content-policy module for MCP resource and tool content, per
plans/mcp-resources-prompts-design.md §4.5 (T3):

- render_text: UTF-8-boundary-safe paging with clamped max_bytes and
  grep-style fancy-regex line filtering (2 lines of context, 1-based
  line-number prefixes, merged hunks); offsets walk the filtered stream.
- render_blob/render_blob_at: streaming base64 decode with a 50 MiB
  ceiling, UTF-8 sniff, sha256-named 0600 spill files under a sanitized
  server dir with a fixed mime->ext allowlist, and best-effort
  oldest-first eviction bounding the spill tree at 512 MiB.

Not yet wired to call sites; module carries #![allow(dead_code)] until
the read/prompt surfaces land.

src/mcp/mod.rs

@@ -1,6 +1,7 @@
 mod auth_client;
 pub(crate) mod manage;
 pub(crate) mod oauth;
+pub(crate) mod render;
 mod sse_transport;
 
 use crate::config::AppConfig;