Carry RateLimitMiddleware through vMCP buildServeConfig (#5500)

#5276 added Config.RateLimitMiddleware and wired it on the New/Config
path, but the parallel Serve/ServerConfig migration API was not extended:
ServerConfig had no RateLimitMiddleware field and buildServeConfig did
not map it, so TestBuildServeConfigMapsSharedFields fails on main and the
Serve path would silently drop rate limiting.

Add the field to ServerConfig, map it in buildServeConfig, and set it in
the completeness test's source config so a dropped mapping keeps failing
the test.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ChrisJBurns

pkg/vmcp/server/serve.go

@@ -69,6 +69,10 @@ type ServerConfig struct {
 	// If nil, no authentication is required.
 	AuthMiddleware func(http.Handler) http.Handler
 
+	// RateLimitMiddleware is the optional rate-limit middleware to apply after
+	// authentication and MCP request parsing.
+	RateLimitMiddleware func(http.Handler) http.Handler
+
 	// AuthInfoHandler is the optional handler for the
 	// /.well-known/oauth-protected-resource endpoint.
 	AuthInfoHandler http.Handler
@@ -302,6 +306,7 @@ func buildServeConfig(cfg *ServerConfig) *Config {
 		EndpointPath:            cmp.Or(cfg.EndpointPath, defaultEndpointPath),
 		SessionTTL:              cmp.Or(cfg.SessionTTL, defaultSessionTTL),
 		AuthMiddleware:          cfg.AuthMiddleware,
+		RateLimitMiddleware:     cfg.RateLimitMiddleware,
 		AuthInfoHandler:         cfg.AuthInfoHandler,
 		AuthServer:              cfg.AuthServer,
 		TelemetryProvider:       cfg.TelemetryProvider,

pkg/vmcp/server/serve_test.go

@@ -347,6 +347,7 @@ func TestBuildServeConfigMapsSharedFields(t *testing.T) {
 		EndpointPath:            "/e",
 		SessionTTL:              time.Second,
 		AuthMiddleware:          func(h http.Handler) http.Handler { return h },
+		RateLimitMiddleware:     func(h http.Handler) http.Handler { return h },
 		AuthInfoHandler:         http.NewServeMux(),
 		AuthServer:              &asrunner.EmbeddedAuthServer{},
 		HealthMonitor:           &health.Monitor{},