fix(files): S-6 identify goes through the shared TMDB limiter and caps remote queries

- invoke-limits: sharedInvokeLimiter() (one semaphore set per process); agent
  capability routes default to it
- /files/identify: catalog.lookup with includeRemote runs under the shared
  TMDB semaphore + 15s timeout; at most 20 distinct remote queries per
  request, further items fall back to local recall with a warning

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/modules/agent/routes.ts

@@ -14,7 +14,7 @@ import type { ModuleApp, ServerContext } from "../types.ts";
 import { planBinding } from "./authorize.ts";
 import { cancelTask, retryTask, taskToApi } from "./capabilities.ts";
 import { route } from "./http.ts";
-import { createInvokeLimiter, type InvokeLimiter, UpstreamBusyError, UpstreamTimeoutError } from "./invoke-limits.ts";
+import { type InvokeLimiter, sharedInvokeLimiter, UpstreamBusyError, UpstreamTimeoutError } from "./invoke-limits.ts";
 import { AgentRunError, abortRun, appendMessage, startRun } from "./service.ts";
 
 // Agent 会话 API、持续授权 / 单次审批、能力目录与调用、业务任务。
@@ -89,7 +89,7 @@ const decode = (c?: string) => {
 export function registerAgentRoutes(
   app: ModuleApp,
   ctx: ServerContext,
-  limiter: InvokeLimiter = createInvokeLimiter(),
+  limiter: InvokeLimiter = sharedInvokeLimiter(),
 ) {
   const db = () => ctx.db;