Go MCP Server 项目初始化：工具注册架构 + 编译运行通过

- Tool 接口 + Registry 注册中心，工具模块化插拔
- system 工具：health / info
- database 工具：db_query / db_tables / db_table_info / db_explain（四层 SQL 安全）
- docker 工具：docker_ps / docker_logs / docker_inspect（白名单 + 大小限制）
- middleware：auth（JWT+APIKey）/ ratelimit（令牌桶）/ audit（slog 结构化）
- stdio / SSE 双传输模式，Viper 多环境配置
- Dockerfile 多阶段构建（golang:alpine → scratch），~15MB 镜像
- docker-compose.yml 一键部署 + 安全加固（read_only / no-new-privileges / cap_drop）
- go build ./... / go vet ./... / go test ./... 全部通过

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/middleware/ratelimit.go

@@ -0,0 +1,53 @@
+package middleware
+
+import (
+	"net/http"
+	"sync"
+
+	"golang.org/x/time/rate"
+)
+
+// RateLimiter 基于调用方标识的令牌桶限流。
+type RateLimiter struct {
+	limiters map[string]*rate.Limiter
+	rate     rate.Limit
+	burst    int
+	mu       sync.Mutex
+}
+
+func NewRateLimiter(r rate.Limit, burst int) *RateLimiter {
+	return &RateLimiter{
+		limiters: make(map[string]*rate.Limiter),
+		rate:     r,
+		burst:    burst,
+	}
+}
+
+func (rl *RateLimiter) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		subject := "anonymous"
+		if sub, ok := r.Context().Value(KeySubject).(string); ok {
+			subject = sub
+		}
+
+		limiter := rl.getLimiter(subject)
+		if !limiter.Allow() {
+			http.Error(w, "rate limit exceeded", http.StatusTooManyRequests)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (rl *RateLimiter) getLimiter(key string) *rate.Limiter {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	limiter, ok := rl.limiters[key]
+	if !ok {
+		limiter = rate.NewLimiter(rl.rate, rl.burst)
+		rl.limiters[key] = limiter
+	}
+	return limiter
+}