mcp: throttle transport read requests

TASKS.md

@@ -2,20 +2,19 @@
 
 ## Current
 
-### `feat/distributed-mcp-session-store`
+### `feat/runtime-rate-limiting-and-backpressure`
 
 Status: in_progress
 
 DoD:
-- transport sessions are stored behind a shared store abstraction
-- mcp-server no longer depends directly on process-local session storage implementation
-- in-memory session store remains available for tests and local fallback
-- production mcp-server uses a Postgres-backed transport session store
-- expired transport sessions are evicted on read and no longer leak indefinitely
+- runtime concurrency limits reject overload deterministically
+- mcp-server transport requests are throttled on ingress across `POST`, `GET`, and `DELETE`
+- streaming poll pressure is bounded for stream sessions and async jobs
+- admin-api ingress requests are throttled with stable `429` behavior
 
 ## Next
 
-- `feat/runtime-rate-limiting-and-backpressure`
+- `feat/distributed-mcp-session-store`
 
 ## Backlog