fix(config): wire K8s env vars into HiveStack and API server

[cursor]

Bug and impact

K8s/Helm deployments set HIVE_VALIDATE_INPUTS, HIVE_RATE_LIMIT, HIVE_MAX_NODES, HIVE_MAX_CONTENT_BYTES, and TTL env vars, but scripts/hive_api_server.py constructed HiveStack() with hardcoded defaults and never called HiveConfig.from_env().

Impact:

• HIVE_VALIDATE_INPUTS=true had no effect — malformed /route payloads were accepted despite schema validation being "enabled" in the manifest
• HIVE_RATE_LIMIT was ignored — no rate limiting in production
• HIVE_MAX_NODES / memory caps were ignored — RustBrain always used the 10k default regardless of operator config
• HIVE_MAX_CONTENT_BYTES was ignored — compress DoS limit not applied from env

Root cause

HiveConfig was introduced for enterprise deployments but only partially wired into HiveStack (tenant_isolation, default_ttl_s, validate_inputs). The REST API server never loaded config from the environment. K8s manifests also used HIVE_MAX_NODES while the config field maps to HIVE_MAX_MEMORY_NODES.

Fix

• Load HiveConfig.from_env() in hive_api_server.py
• Pass max_memory_nodes → RustBrain(max_nodes=...)
• Apply max_content_bytes from config when not explicitly overridden
• Auto-create RateLimiter when rate_limit > 0
• Accept HIVE_MAX_NODES as alias for max_memory_nodes

Validation

• 180 tests pass (4 new regression tests for env wiring and API validation)