Security hardening: plugin safety and /health info leak

[bburda]

Summary

The plugin layer and /health endpoint need hardening before production use. A hanging or malicious plugin can DoS the gateway, and the /health endpoint leaks internal topology to unauthenticated callers.

---

Proposed solution (optional)

Four related items, all plugin/security themed:

1. Plugin discover() timeout

MergePipeline::execute() calls each layer's discover() synchronously with no timeout. A hanging plugin blocks ALL discovery cycles permanently - the gateway serves stale data.

File: src/ros2_medkit_gateway/src/discovery/merge_pipeline.cpp:407-415

Fix: Run plugin discover() via std::async with std::future::wait_for(). Add configurable discovery.plugin_timeout_ms (default 5000ms). Disable plugin after N consecutive timeouts.

2. Per-layer entity count limit

PluginLayer::discover() has no cap on entity count. A plugin can return millions of entities, exhausting gateway memory.

File: src/ros2_medkit_gateway/src/discovery/layers/plugin_layer.cpp:64-74

Fix: Add discovery.plugin_max_entities config (default 10000). Truncate + warn if exceeded.

3. Plugin field content validation

Entity IDs are validated (format + length), but other fields (name, description, tags) accept arbitrary-length strings from plugins.

Fix: Add length limits: name max 256 chars, description max 4096 chars, tags max 100 entries with 256 chars each.

4. Gate /health discovery section behind auth

The /health endpoint is exempt from authentication but now exposes:

• Merge pipeline conflict details with entity IDs
• linking->warnings containing strings like "App 'engine_ecu' cannot bind to '/nav/controller'" - leaking ROS 2 graph topology

File: src/ros2_medkit_gateway/src/http/handlers/health_handlers.cpp:42-57

Fix: Return only {"status": "healthy", "timestamp": ...} for unauthenticated requests. Gate the discovery section behind auth, or strip entity IDs/FQNs.

---

Additional context (optional)

Found during self-review of PR #258. All items are defense-in-depth - plugins already run in-process, but these changes limit the blast radius of bugs and prevent accidental info leaks.