fix(security): reject ':' in tenant ids, count only POSTs for eve rate limit

[CahidArda]

Summary

Hardens the per-user tenant boundary and fixes the eve rate-limit double-count,
plus a sweep of stale docs/docstrings found in review. Folded into the existing
harden-tenant-isolation changeset (no new changeset).

Tenant isolation — reject : in ids

The whole isolation model rests on the key shape <prefix>:<userId>:<...>, but
only emptiness was validated. A : in an id let keys collide across users — e.g.
user "a" + session "b:c" resolves to the same Redis key as user "a:b" +
session "c", so the direct-key paths (getChat/saveChat/deleteChat/forget)
could read or overwrite another user's data. The search-backed methods were safe
(they filter on the userId field), which is why it was easy to miss.

• AgentMemory, ChatHistory, ToolCache now reject a : in userId /
  sessionId / toolName up front (alongside the existing non-empty check).
• Added unit tests for the rejection across all three primitives.

eve rate limiting — count only POSTs

eve drives each turn as two authenticated requests — the message POST plus
a follow-up GET …/stream that opens the reply stream — and the auth walk runs on
both, so createRateLimitAuth was charging every turn twice (a slidingWindow(20)
was really ~10 turns/min).

• createRateLimitAuth now throttles only POST requests, so one turn = one
  token; session-read GETs fall through unthrottled.
• Tradeoff: the stream GET is no longer rate-limited (it requires a valid
  session id to reach). Documented in the README + docstring.
• Updated tests (a bare Request defaults to GET).

Docs

• Document deriving userId from a verified server-side auth source (Clerk,
  Auth.js/NextAuth, Supabase Auth, Auth0, …), never a client-supplied value;
  added ⚠️ DEMO ONLY warnings to the ai-sdk-demo routes that trust an
  x-user-id header.
• Dropped @upstash/agentkit-sdk from the eve README install command — it's
  already a regular dependency, not something users install.
• Fixed stale references: search-tools {@link withIndex} →
  ReactiveSearchIndex; ai-sdk memory "scope" → "userId"; corrected CLAUDE.md's
  superseded namespace key-naming note.

Testing

• SDK + eve unit tests pass against live Redis (incl. new colon-rejection and
  GET-skip tests); pnpm typecheck and pnpm lint clean.

Notes

• The :-rejection is a behavior change (callers passing colon-bearing ids now
  throw), but it lands within the already-unreleased breaking harden-tenant-isolation
  line, so it's captured in that changeset rather than a new one.