fix: force parameterless ResponseIdValidationService ctor via factory; fix XML doc exception type

- Register ResponseIdValidationService via AddSingleton factory lambda
  (_ => new ResponseIdValidationService()) so DI always calls the
  parameterless ctor that creates the owned, size-limited MemoryCache.
  Without this, ASP.NET Core DI prefers the IMemoryCache ctor (matching
  the registered IMemoryCache from AddMemoryCache()), defeating the
  dedicated cache design.
- Update CreateTokenAsync XML doc: references TokenLimitExceededException
  instead of the base InvalidOperationException, so callers know the
  concrete type to catch.

Author: BenjaminMichaelis

EssentialCSharp.Web/Program.cs

@@ -260,7 +260,7 @@ private static void Main(string[] args)
         builder.Services.AddScoped<McpApiTokenService>();
 
         builder.Services.AddMemoryCache();
-        builder.Services.AddSingleton<ResponseIdValidationService>();
+        builder.Services.AddSingleton(_ => new ResponseIdValidationService());
 
         builder.Services.AddAuthentication()
             .AddScheme<AuthenticationSchemeOptions, McpApiKeyAuthenticationHandler>(

EssentialCSharp.Web/Services/McpApiTokenService.cs

@@ -32,7 +32,7 @@ public static string GenerateRawToken()
     /// <summary>
     /// Creates a new named API token for the specified user.
     /// Returns the raw token (shown once — never stored).
-    /// Throws <see cref="InvalidOperationException"/> if the user is already at <see cref="MaxTokensPerUser"/>.
+    /// Throws <see cref="TokenLimitExceededException"/> if the user is already at <see cref="MaxTokensPerUser"/>.
     /// The limit check and insert are wrapped in a serializable transaction to prevent races.
     /// </summary>
     public async Task<(string RawToken, McpApiToken Entity)> CreateTokenAsync(