fix: add security hardening and documentation for deployment

- Add document validation to prevent NoneType crash when document not configured
- Add SQL query validation (SELECT only, no multi-statement)
- Add 30-second HTTP request timeout
- Fix filter parameter JSON encoding for get_records
- Add return type annotation to get_document
- Add tests for document lookup and SQL validation
- Add comprehensive README with usage instructions

src/grist_mcp/auth.py

@@ -67,6 +67,14 @@ class Authenticator:
             for scope in agent._token_obj.scope
         ]
 
-    def get_document(self, document_name: str):
-        """Get document config by name."""
-        return self._config.documents.get(document_name)
+    def get_document(self, document_name: str) -> "Document":
+        """Get document config by name.
+
+        Raises:
+            AuthError: If document is not configured.
+        """
+        from grist_mcp.config import Document
+        doc = self._config.documents.get(document_name)
+        if doc is None:
+            raise AuthError(f"Document '{document_name}' not configured")
+        return doc