feat(search): bound default result count and add include_hidden

Two file_search gaps:
- max_results defaulted to 0 (unbounded), so a broad pattern returned every match — unbounded memory + token blowup. The configured MaxSearchResults (default 1000) existed but was dead; wire it as the builtIn default. Explicit max_results still wins, and the cursor footer pages the rest.
- search.Request.IncludeHidden was a dead field with no tool param. Add an include_hidden bool (default false) so dotfiles (.github/, etc.) are searchable.

internal/server/handlers_file.go

@@ -61,7 +61,10 @@ func (s *Server) handleFileSearch(ctx context.Context, request mcp.CallToolReque
 		prefsMaxResults = prefs.DefaultMaxResults
 		prefsCluster = prefs.DefaultCluster
 	}
-	maxResults := effectiveInt(request, "max_results", prefsMaxResults, 0)
+	// Default to the configured cap (not 0/unbounded) so a broad pattern can't
+	// flood memory and the context window; an explicit max_results still wins,
+	// and the cursor footer lets the caller page through the rest.
+	maxResults := effectiveInt(request, "max_results", prefsMaxResults, s.cfg.MaxSearchResults)
 	cluster := effectiveBool(request, "cluster", prefsCluster, false)
 
 	cursorStr := request.GetString("cursor", "")
@@ -97,13 +100,14 @@ func (s *Server) handleFileSearch(ctx context.Context, request mcp.CallToolReque
 	}
 
 	req := &search.Request{
-		Pattern:      pattern,
-		Paths:        paths,
-		FileTypes:    fileTypes,
-		IgnoreCase:   ignoreCase,
-		Regex:        regex,
-		ContextLines: contextLines,
-		MaxResults:   rgMaxResults,
+		Pattern:       pattern,
+		Paths:         paths,
+		FileTypes:     fileTypes,
+		IgnoreCase:    ignoreCase,
+		Regex:         regex,
+		ContextLines:  contextLines,
+		MaxResults:    rgMaxResults,
+		IncludeHidden: request.GetBool("include_hidden", false),
 	}
 
 	results, err := s.searcher.Search(ctx, req)

internal/server/server.go

@@ -129,6 +129,9 @@ func (s *Server) registerTools() {
 				mcp.WithBoolean("ignore_case",
 					mcp.Description("Case insensitive search"),
 				),
+				mcp.WithBoolean("include_hidden",
+					mcp.Description("Search hidden files and directories (dotfiles like .github/). Default: false."),
+				),
 				mcp.WithBoolean("regex",
 					mcp.Description("Treat pattern as regex (default: true)"),
 				),