Merge origin/main with local pending work and update AGENTS.md references

- Resolve 14 conflicts from popping local stash on top of origin's
  eed1e88 + 8d3352f doc-comment additions (11 mechanical, plus
  version.rs, DashboardAuthenticatorTests.cs, DashboardGalaxyProjector.cs)
- Fix 4 test files that used AGENTS.md as the repo-root sentinel
  (now use CLAUDE.md, since AGENTS.md was removed in 4731ab5)
- Redirect 10 doc citations from AGENTS.md to the matching gateway.md
  sections (Value Model, Status Model, Security, STA Worker Thread
  Model, gRPC Layer rule, cancellation rule)

Verified: solution build clean, x86 worker build clean, 266/266
gateway tests passing, 121/121 worker tests passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.Server/Security/Authorization/GrpcAuthorizationServiceCollectionExtensions.cs

@@ -1,4 +1,6 @@
 using Grpc.Core.Interceptors;
+using Microsoft.Extensions.Configuration;
+using MxGateway.Server.Configuration;
 
 namespace MxGateway.Server.Security.Authorization;
 
@@ -15,7 +17,17 @@ public static class GrpcAuthorizationServiceCollectionExtensions
     {
         services.AddSingleton<GatewayGrpcScopeResolver>();
         services.AddSingleton<IGatewayRequestIdentityAccessor, GatewayRequestIdentityAccessor>();
+        services.AddSingleton<IConstraintEnforcer, ConstraintEnforcer>();
         services.AddSingleton<GatewayGrpcAuthorizationInterceptor>();
+        services
+            .AddOptions<global::Grpc.AspNetCore.Server.GrpcServiceOptions>()
+            .Configure<IConfiguration>((grpcOptions, configuration) =>
+            {
+                ProtocolOptions protocolOptions = new();
+                configuration.GetSection("MxGateway:Protocol").Bind(protocolOptions);
+                grpcOptions.MaxReceiveMessageSize = protocolOptions.MaxGrpcMessageBytes;
+                grpcOptions.MaxSendMessageSize = protocolOptions.MaxGrpcMessageBytes;
+            });
         services.AddGrpc(options => options.Interceptors.Add<GatewayGrpcAuthorizationInterceptor>());
 
         return services;