harden ember-server: grpc limits, scan cap, gossip port overflow

[kacy]

summary

security hardening for ember-server, addressing findings #4, #7, #9, #12 from the security audit.

• clippy result_large_err: added #[allow(clippy::result_large_err)] on validate_key and validate_value with justification — tonic's Status is the idiomatic error type
• grpc message size limits: set explicit 4 MB max decoding/encoding message size on the grpc service (tonic defaults to 4 MB but we now state it explicitly)
• SCAN count cap: req.count is now capped at 10,000 to prevent a client from requesting unbounded iteration
• gossip port overflow: replaced saturating_add with checked_add at both gossip port calculation sites — prevents silent port collision when offset overflows u16
• cargo fmt: fixed formatting drift from recently merged refactoring PRs

what was tested

• cargo build --workspace --features protobuf,grpc,vector — clean
• cargo test -p ember-server --features protobuf,grpc,vector — 43/43 pass
• cargo clippy --workspace --features protobuf,grpc,vector -- -D warnings — clean
• cargo fmt --all --check — clean

design considerations

• result_large_err is suppressed rather than fixed because boxing tonic::Status would add allocation overhead on every validation call for no practical benefit. the lint exists for types that are unexpectedly large; 176 bytes for an error type in a non-hot-path is fine.
• SCAN count is silently capped (not rejected) to match redis behavior — redis also clamps count internally.
• gossip port uses expect() in the constructor (startup) since an invalid port config is a fatal error, and checked_add + early return in spawn_gossip() since that runs after initialization.