fix(serve): better MCP tool descriptions, depth default 1, filename guard

[sdeonvacation]

What this changes

Three improvements to `graphify/serve.py` (the MCP server). All 433 tests pass, ruff clean.

1. Better tool descriptions with usage guidance

Tool descriptions now tell the LLM when to use and when not to:

• `query_graph`: adds explicit "Do NOT use for: exact string literals, regex patterns, or property names — use grep/search tools for those instead"
• `get_node` / `get_neighbors`: clarify they take symbol names, not filenames (e.g. `'DigestAuth'`, not `'auth.py'`)
• `god_nodes`: adds "Best used once at session start for orientation. Not useful during targeted investigations."
• `shortest_path`: adds "Use symbol names, not filenames."

Without this guidance, LLMs routinely pass filenames to `get_node` and get confusing "not found" errors.

2. `query_graph` depth default: 3 → 1

Depth 3 on a large code graph (400+ files) can return 500+ nodes in a single traversal, blowing the token budget and returning noise. Depth 1 returns a focused subgraph centered on the matching nodes. Users can increase if results are too sparse. Description updated accordingly.

3. Filename guard in `get_node` and `get_neighbors`

Before this change, passing `'auth.py'` to `get_node` returns `"No node matching 'auth.py' found."` — unhelpful.

After:
```
'auth.py' looks like a filename, not a symbol. Pass a class or function name instead. Symbols in that file: DigestAuth, BasicAuth, BearerAuth, NetRCAuth, Auth.
```

Two new helpers added — no new imports, no hardcoded extension lists:

• `_is_filename(G, label)` — checks the graph itself: returns `True` if a node with that label exists whose `source_file` ends with the label. Works for any language graphify supports.
• `_symbols_in_file(G, filename, limit=8)` — returns top-degree symbols from that file as a hint, filtered by the same `source_file.endswith` logic.

Checklist

• All 433 existing tests pass
• `ruff check` clean
• No new imports or dependencies
• Surgical changes — only `serve.py` modified (+70/-14 lines)