Bound the retrieval scope of server() by default #7

challenge / use case

server(store, scope) bounds client templates only as far as scope states: omitted, or with depth and limit
left out, a client may ask for arbitrarily deep nesting and unbounded collections, so a public endpoint is open to
expensive queries unless every deployment remembers to set the bounds by hand, e.g.

server(store, { depth: 3, limit: 100 })

proposal

Make server() safe by default: apply finite depth and limit bounds when scope leaves them unstated, and let
deployments widen them explicitly, with 0 (or another explicit value) opting back into unbounded nesting or pages.

notes

The scope is declared by StoreScope in @metreeca/keep, which documents both members as unbounded by default, and
enforced through @metreeca/blue validation; the defaults could live in either place, but server() is where an
untrusted client first reaches the store.