fix(dimensions): diameter and radius callouts measured the leader as geometry

`add_diameter_dim` / `add_radius_dim` measure to the point they are handed;
`leader_length` is a text placement. The ezdxf backend passed
`centre + (radius + leader)` as that point, so the leader became part of the
measurement: a true 40 mm bore was dimensioned 60 at the default
`leader_length=10`, and 108 at 34. Radius callouts were `leader_length` too
large the same way.

This is the worst class of defect for this project -- a wrong number, at
default settings, on the one part of a drawing that exists to carry numbers --
and it shipped in v1.4.0 and earlier. The size now comes from `radius` and
`location` only places the text.

The live COM backend was never affected: ActiveX's AddDimDiametric takes the
two chord points and the leader length as separate arguments. The two engines
had been disagreeing by 2 x leader_length on the same call.

Found while building the drawing for the new README, whose own bore callout was
wrong. Two checks added to correctness_suite.py; both report fail -> pass
against v1.4.0, not miss -> pass, which is what separates a repaired defect
from new capability in that lane. A/B is now 21/26 -> 26/26, five fixed, zero
regressed.

README rewritten from scratch
- Hero is a real ISO A3 sheet the server drew: m6 z24 involute spur gear, DIN
  6885 keyed bore, section A-A, ISO 129 dimensions, ISO 286 H7 fit, ISO 7200
  title block, 56 entities, drawing_critique clean. New
  scripts/render_readme_showcase.py rebuilds it, and the tool-call sequence
  that produces it is printed in the page.
- Star history chart, badge row, capability matrix, five evidence lanes, and a
  "what this release is bad at" section carrying the 28% throughput regression.
- Every image and repo link is now an absolute URL: README.md is the PyPI long
  description, where relative paths 404.

Corrections this work forced, all measured
- The df=0 example was wrong. FILLET is already in entity_fillet's own text;
  the commands that genuinely scored zero are WBLOCK, PEDIT, OVERKILL,
  LAYTRANS and MATCHPROP.
- 40,305 tokens is the tools/list wire payload; ~25,143 is the part forwarded
  to the model. The old wording said "of schema", which is neither.
- `--tokenizer anthropic` needs a package and credentials this repo does not
  lock, and refuses rather than falling back. Said so.
- Discovery ranks over the 149-tool advertised catalog, not the 154 registered.
- Five middlewares, not four; the fifth is what makes refusals machine-readable.
- Five of the 27 capability keys are environment-dependent, so the matrix
  carries footnotes instead of bare ticks.
- "Every coordinate is WCS" has one deliberate exception: TEXT rotation.
- render_live_chart's axis still said "fixed 10-task matrix" while our bar came
  from v3's fifteen. Each bar now carries its own matrix.
- .env.example said MAX_UNDO_STACK=50 (code: 5) and omitted four real
  variables, two of them the remote-HTTP controls.
- server.json described an empty ALLOWED_PATHS as blocking access. It disables
  the allowlist.
- server.py called the lean profile ~46 tools; it is 47.
- backends/capability.py cited a test file that does not exist.

1249 passed, 1 xfailed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -37,8 +37,9 @@ CAD_PROGID=AutoCAD.Application
 # Example: ALLOWED_PATHS=C:\Drawings,D:\Projects\CAD
 ALLOWED_PATHS=
 
-# Maximum undo stack size (number of snapshots to keep)
-MAX_UNDO_STACK=50
+# Maximum undo stack size (number of snapshots to keep). The code's default is
+# 5; this file used to say 50, which was a documentation-only disagreement.
+MAX_UNDO_STACK=5
 
 # Logging level: DEBUG | INFO | WARNING | ERROR
 LOG_LEVEL=INFO
@@ -75,3 +76,19 @@ EZDXF_UNDO_DEPTH=0
 
 # Opt-in 3D solids (COM backend only; ezdxf reports them as unsupported)
 ENABLE_3D=false
+
+# --- Limits and remote access -------------------------------------------------
+# These four are read by config.py but were missing from this file, which made
+# it look like the complete list. Two of them are the remote-HTTP controls.
+
+# Reject DXF input larger than this many bytes. 0 disables the check.
+MAX_DXF_BYTES=52428800
+
+# Upper bound on list/selection response sizes.
+MAX_LIST_LIMIT=5000
+
+# Permit a non-loopback HTTP bind. Requires MCP_AUTH_TOKEN as well.
+ALLOW_REMOTE_HTTP=false
+
+# Bearer token required for remote HTTP. No default; remote binds refuse without it.
+MCP_AUTH_TOKEN=