Push limit and filters into source functions, dedup B3 quote guard

[robertoecf]

Follow-up cleanup deferred from #29 (curated MCP surface). Cross-file, source-layer changes kept out of #29 to keep that PR contained. Origin: code review of #29.

1. Push limit into the source functions

The API/MCP layers fetch the full dataset then slice (await fn(...))[:limit] in Python, so the duplicated truncation lives at every call site. Sources called this way: companies.get_companies, financials.get_dfp/get_itr, funds.get_fund_catalog/get_fund_daily, lamina.get_fund_lamina/get_fund_monthly_returns/get_fund_yearly_returns, profile.get_fund_profile, fip.get_fip, arrecadacao.get_arrecadacao, empresas.get_susep_empresas, leiloes.get_aneel_leiloes_geracao/_transmissao, anbima.get_ima/get_debentures. bonds.get_treasury_bonds already takes limit and is the model. Add an optional limit: int | None = None (default None preserves current behavior) so truncation happens once, at the source.

2. Dedup the B3 quotes guard

mcp_app._b3_quotes() duplicates routers/b3.py:_quotes() (same lazy yfinance import plus 503). The b3_quote handler body (ticker split, max-20 check, single-vs-multi dispatch) also clones the REST one. Extract a shared resolver and dispatch into findata.sources.b3 and call it from both.

3. Push the anbima emissor filter into the source

mcp_app.anbima_tool filters debentures by emissor substring inside the handler. Every other source-level filter lives in the source module so REST/CLI/MCP share it. Move emissor into anbima.indices.get_debentures.

[robertoecf]

Items 2 and 3 resolved in #31 (merged as b43c6d5): shared B3 quote guard in api/_b3_common.py, and the debenture emissor filter pushed into anbima.get_debentures.

Item 1 (push limit into ~18 source functions) is descoped as cosmetic. The unbounded-output bug it would have addressed was already fixed in #29 (the MCP tools apply [:limit]). Moving the slice into the source functions gives no perf win (the CSV/zip is parsed in full regardless), does not unify the REST routers (which need skip+limit via _page), and would add a limit param to 18 public source functions for marginal DRY. A genuine streaming/lazy-iterator version, if wanted later, is a larger change that deserves its own ticket.