feat(mcp): cap + TTL the NonceStore

[radiosilence]

Summary

Closes #25. The `NonceStore` introduced in #24 was unbounded — PREVIEW without CONFIRM would grow the map forever. Low impact (trusted local MCP caller) but should still be bounded.

Changes

• `Nonce` is now a struct carrying `fingerprint` + `issued_at: Instant`. The map type becomes `HashMap<String, Nonce>`.
• 15-minute TTL per nonce. Swept from the map on every `issue_nonce` call; rejected with "expired" error on `consume_nonce`.
• Hard cap of 256 outstanding nonces. When full, the oldest entry (by `issued_at`) is evicted before insertion.
• 7 new unit tests: happy path, missing nonce, reused nonce, tampered params, expired nonce, cap eviction, TTL sweep.

Why these numbers

• TTL = 15 min — long enough for a human to write a draft between PREVIEW and CONFIRM, short enough to bound steady-state memory to minutes rather than process-lifetime.
• Cap = 256 — a single MCP session drafting 256 concurrent emails is already pathological. Well under any memory concern.

Test plan

• `cargo test` — 89 passing (82 previous + 7 new)
• `cargo clippy --all-targets -- -D warnings` — clean
• `cargo fmt -- --check` — clean
• CI green

🤖 Generated with Claude Code