Cap auction count in AuctionListResultParser

SMSG_AUCTION_LIST_RESULT (Classic/TBC/WotLK) improvements:
- Cap auction count to 256 (prevents unbounded memory allocation)
- Each entry is 80-104 bytes depending on expansion
- Prevents DoS from servers sending huge auction lists
- Log warning when cap is reached

Prevents memory exhaustion from malformed auction house packets.

src/game/world_packets.cpp

@@ -4976,6 +4976,13 @@ bool AuctionListResultParser::parse(network::Packet& packet, AuctionListResult&
     if (packet.getSize() - packet.getReadPos() < 4) return false;
 
     uint32_t count = packet.readUInt32();
+    // Cap auction count to prevent unbounded memory allocation
+    const uint32_t MAX_AUCTION_RESULTS = 256;
+    if (count > MAX_AUCTION_RESULTS) {
+        LOG_WARNING("AuctionListResultParser: count capped (requested=", count, ")");
+        count = MAX_AUCTION_RESULTS;
+    }
+
     data.auctions.clear();
     data.auctions.reserve(count);