Bound provider discovery, not just tools/list middleware
Put discovery deadlines at the provider boundary when cold tool lookup can internally refresh schemas. A timeout only around the public tools/list handler leaves that internal path unbounded; a global client request timeout also cuts off legitimate long-running execution. Bound c…