fix(server): cap list_recent days at 365

An unbounded days argument let one call dump the entire corpus; bound
it the same way search_papers bounds limit.

src/papers_mcp/server.py

@@ -26,6 +26,7 @@ CORPORA = {
 DATA_DIR = Path("data")
 REFRESH_INTERVAL_SECONDS = 6 * 60 * 60
 MAX_SEARCH_LIMIT = 50
+MAX_RECENT_DAYS = 365
 
 corpora: dict[str, Corpus] = {}
 indexes: dict[str, SearchIndex] = {}
@@ -128,8 +129,8 @@ def make_server(name: str) -> FastMCP:
     @mcp.tool()
     def list_recent(days: int = 30) -> str:
         """List papers submitted in the last N days, newest first."""
-        if days < 1:
-            raise ValueError("days must be at least 1")
+        if not 1 <= days <= MAX_RECENT_DAYS:
+            raise ValueError(f"days must be between 1 and {MAX_RECENT_DAYS}")
         cutoff = (date.today() - timedelta(days=days)).isoformat()
         recent = sorted(
             (p for p in corpora[name].papers.values() if p.submitted >= cutoff),

tests/test_server.py

@@ -97,3 +97,12 @@ def test_list_recent_tool(client: TestClient) -> None:
     assert len(dates) > 5
     assert dates == sorted(dates, reverse=True)  # newest first
     assert min(dates) >= (date.today() - timedelta(days=365)).isoformat()
+
+
+def test_list_recent_days_over_cap_is_an_error(client: TestClient) -> None:
+    resp = client.post(
+        "/lipsync/mcp",
+        json=rpc("tools/call", {"name": "list_recent", "arguments": {"days": 366}}),
+        headers=MCP_HEADERS,
+    )
+    assert resp.json()["result"]["isError"] is True