fix(csp): use Content-Length framing for MCP stdio transport - #89

[MEDIUM] Simplify empty line detection by checking after stripping suffixes

Symptom: The code checks for an empty line using a boolean expression with three conditions (line == b"\r\n" || line == b"\n" || line.is_empty()) before stripping the trailing newline and carriage return characters.
Source: Ousterhout — A Philosophy of Software Design (Ch. 4: Cognitive Overload / Complexity).
Consequence: The redundant checks increase cognitive load and make the header parsing loop slightly harder to read and maintain.
Remedy: Strip the trailing \r and \n first, then perform a single, unified check for line.is_empty().

[MEDIUM] Avoid unnecessary UTF-8 validation for header name

Symptom: The parse_content_length function converts the header name byte slice to a UTF-8 string before performing a case-insensitive comparison.
Source: Fowler — Refactoring (Primitive Obsession / unnecessary type conversion).
Consequence: Unnecessary UTF-8 validation is performed on the header name, which adds minor overhead and extra code.
Remedy: Use eq_ignore_ascii_case directly on the byte slice name with b"Content-Length".

fn parse_content_length(line: &[u8]) -> Option<usize> {
    let mut parts = line.splitn(2, |&b| b == b':');
    let name = parts.next()?;
    let value = parts.next()?;

    if !name.eq_ignore_ascii_case(b"Content-Length") {
        return None;
    }

    let value = std::str::from_utf8(value).ok()?;
    value.trim().parse::<usize>().ok()
}

[MEDIUM] Simplify skip_exact using tokio::io::copy and tokio::io::sink

Symptom: The skip_exact function manually manages a 4KB buffer and a loop to discard bytes from the reader.
Source: Fowler — Refactoring (Alternative Classes with Different Interfaces / standard library reuse).
Consequence: Manual buffer management and loop logic increase code complexity and the potential for bugs compared to using standard Tokio utilities.
Remedy: Use tokio::io::copy with read.take(n) and tokio::io::sink() to discard the bytes efficiently and cleanly.

async fn skip_exact<R: AsyncReadExt + Unpin>(
    read: &mut R,
    n: usize,
) -> Result<(), std::io::Error> {
    let mut discard = read.take(n as u64);
    tokio::io::copy(&mut discard, &mut tokio::io::sink()).await?;
    Ok(())
}

Unbounded MCP header allocation

When an MCP client writes a long header line without a newline, read_until grows line without limit before the 8 MiB body check runs, causing memory exhaustion and making the MCP session unavailable. Bound both individual header lines and the complete header block while parsing. How this was verified: The client-controlled stdin reaches this unbounded allocation before any message-size guard is applied.

Knowledge Base Used: MCP server

This is a comment left during a code review.
Path: crates/csp/src/bin/csp/mcp_transport.rs
Line: 119-120

Comment:
**Unbounded MCP header allocation**

When an MCP client writes a long header line without a newline, `read_until` grows `line` without limit before the 8 MiB body check runs, causing memory exhaustion and making the MCP session unavailable. Bound both individual header lines and the complete header block while parsing. **How this was verified:** The client-controlled stdin reaches this unbounded allocation before any message-size guard is applied.

**Knowledge Base Used:** [MCP server](https://app.greptile.com/passionfactory/-/custom-context/knowledge-base/pleaseai/code-search/-/docs/mcp-server.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.