server

type Deps struct {
	DB            *gorm.DB
	MCPServer     *mcp.Server
	KeyValidator  *auth.APIKeyValidator
	AuthletWiring *authletas.Wiring // optional; nil = API-key-only path
	Memory        *service.MemoryService
	UIClientID    string

	// ImportJobs backs the admin async-import surface; ImportMaxUploadBytes caps
	// each uploaded archive (config.ImportMaxUploadBytes).
	ImportJobs           importJobStore
	ImportMaxUploadBytes int64

	// PublicBaseURL is the server's external origin (scheme+host, no trailing
	// slash); the UI's OAuth config is derived from it so login works on any host.
	PublicBaseURL string

	// HTTP hardening. MaxRequestBytes caps every request body (<= 0 disables).
	// RateLimitRPS <= 0 disables the throttle — the zero value leaves tests and
	// the API-key-only path unthrottled. RateLimitTrustedProxyDepth is the count of
	// trusted reverse-proxy/CDN hops for spoof-safe client-IP keying (0 = trust none).
	MaxRequestBytes            int64
	RateLimitRPS               float64
	RateLimitBurst             int
	RateLimitTrustedProxyDepth int
}