Constant HARD_CAP 

pub const HARD_CAP: usize = 10_000;

Per-call upper bound on FilesApi::search_all, even when the caller passes limit = 0.

Mirrors crate::gmail::messages_api::HARD_CAP verbatim — same safety rationale, no Drive-specific derivation.