Remove redundant API request hot-path work

[tiankaima]

Closes #486.
Closes #487.
Closes #488.
Closes #489.

Summary

• reuse the session already resolved by the application hook instead of resolving Better Auth twice on cookie-authenticated API requests
• reject oversized MCP requests before JSON parsing and document the 413 response
• remove duplicate GraphQL cost enforcement while retaining one explicit limit
• serve the generated OpenAPI document without a deep-copy/re-serialize hot path
• keep CLI docs: add AGENTS.md with Cursor Cloud development instructions #22 and Bot feat: add shuttle bus support #24 generated clients at exact contract parity

Verification

• latest server main merged normally; no rebase or force-push
• OpenAPI server/CLI/Bot SHA-256: 52d26d49c2483ef907aa769a3cdd09341cce0dd955eb6442c888e8598f96c6e2
• official isolated Playwright shards: 176 + 173 + 172 + 170 passed, 1 intentional skip (692 total)
• 204 Vitest files / 1213 tests; 32 integration files / 183 tests
• build, Svelte check 0/0, all three TypeScript configs, Biome, OpenAPI drift checks
• review threads: none

Companion merge order

Merge CLI #22 and Bot #24 first, then this server PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	life-ustc	3bec758	Commit Preview URL Branch Preview URL	Jul 19 2026, 12:15 PM

[github-actions]

E2E HTML report is ready: https://life-ustc.github.io/e2e-snapshot-artifacts/reports/29686616495/index.html
All reports: https://life-ustc.github.io/e2e-snapshot-artifacts/

[tiankaima]

Cross-repository compatibility is now covered by the consolidated companion PRs: Life-USTC/cli#22 and Life-USTC/bot#24. Both use this branch’s exact generated OpenAPI when the matching branch exists; both hosted CI workflows are green.

[github-actions]

🎉 This PR is included in version 1.64.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀