fix(memory,a2a)!: harden Qdrant search limits and A2A trust defaults

[bug-ops]

Summary

Four low-severity, defense-in-depth hardening fixes from a security audit sweep of zeph-memory Qdrant query construction and zeph-a2a trust boundary. None were independently exploitable — each closes a footgun that becomes real only if a future call site omits a safeguard that currently exists exactly once.

• zeph-memory: clamp caller-supplied limit/top_k to [1, 100] directly inside EmbeddingStore::search/search_collection, EmbeddingRegistry::search_raw, and ReasoningMemory::retrieve_by_embedding, instead of relying on the sole external MCP-tool clamp. Logs a one-shot warning when the clamp actually reduces a caller's requested value (covers config-driven pools like memory.retrieval.depth exceeding the ceiling).
• zeph-config: non-fatal warning when memory.qdrant_url is non-loopback and lacks TLS and/or an API key.
• zeph-a2a: kept CardTrustPolicy::Ignore as the default (behavior-preserving), but now log a warning (and surface it in the TUI chat pane) when it's in effect, so operators know peer AgentCard verification is off.
• zeph-a2a: A2aClient::new now requires an explicit SecurityPolicy argument instead of silently defaulting to permissive(). Added A2aClient::new_insecure() for callers that want the old behavior explicitly.

Closes #6553

Breaking change

A2aClient::new(client) → A2aClient::new(client, policy) or A2aClient::new_insecure(client). zeph-a2a is a published crate; no workspace version bump in this PR (handled separately via /rust-release), consistent with prior precedent for this crate.

Test plan

• Unit tests for the 4 search-limit clamp sites (count assertions where a test seam exists, log assertions elsewhere)
• Unit tests for the Qdrant TLS/auth config-validation warning (loopback skip, non-loopback fire)
• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (15000 passed)
• Rustdoc gate (RUSTFLAGS=-D warnings + RUSTDOCFLAGS=--deny rustdoc::broken_intra_doc_links)
• gitleaks protect --staged
• Adversarial implementation critique (2 rounds — found and fixed a silent recall-pool truncation gap before merge)
• Independent code review with a fresh full check-suite run