fix: accept null tool arguments and bound HTTP resource use

Review follow-ups on the SDK migration.

An "arguments": null is what clients send for parameterless tools like get_me,
and what mcp-go accepted by returning a nil map. The new adapter rejected it
with InvalidParams, which broke those calls outright.

The /mcp endpoint took unlimited request bodies and never expired idle
sessions, so a peer that goes away without DELETE kept its session for the
process lifetime. Both are reachable before any token check, so neither can
stay unbounded; the body cap sits above the SDK default to leave room for the
base64 content create_or_update_file accepts.

Required() smuggled a bool through the property schema map and deleted it
again, colliding with the JSON Schema keyword of the same name. It now sets a
field on Property, so an object property can carry its own required list.

The tool contract fixture cost a manual regeneration step and four
hand-maintained counts on every tool change, and a snapshot freezes defects
rather than reporting them. Property assertions cover the same surface and
reject a duplicate tool name, a readOnlyHint that disagrees with the register
call, and a default that contradicts its own type or enum.

Co-Authored-By: Claude (Opus 5) <noreply@anthropic.com>

pkg/tool/definition_test.go

@@ -1,7 +1,6 @@
 package tool
 
 import (
-	"encoding/json"
 	"reflect"
 	"testing"
 
@@ -58,14 +57,6 @@ func TestNewDefinition(t *testing.T) {
 	if !reflect.DeepEqual(definition.InputSchema, want) {
 		t.Errorf("InputSchema = %#v, want %#v", definition.InputSchema, want)
 	}
-
-	data, err := json.Marshal(definition)
-	if err != nil {
-		t.Fatalf("json.Marshal() error = %v", err)
-	}
-	if !json.Valid(data) {
-		t.Fatalf("json.Marshal() returned invalid JSON: %s", data)
-	}
 }
 
 func TestNewDefinitionWithoutRequiredProperties(t *testing.T) {