security(api): enforce global and endpoint-specific request body limits #686

Parent epic: #679

Evidence

Most API handlers call request.json() or request.text() without an application-level size cap. Reverse-proxy limits alone do not protect direct/local access or endpoint-specific resource use.

Objective

Reject oversized request bodies predictably before unbounded buffering or parsing.

Scope

• Add a shared capped body reader for JSON, text, form, and supported multipart inputs.
• Enforce a conservative global ceiling plus explicit endpoint tiers.
• Validate Content-Length when present and enforce streamed byte counts when absent/chunked.
• Return the standard safe 413 Payload Too Large response with correlation ID.
• Align nginx/proxy documentation and readiness checks with app limits.
• Add OpenAPI request-size documentation where useful.

Guardrails

• Do not log rejected body content.
• Preserve offline/LAN direct-access behavior.
• Upload/media endpoints must use bounded streaming or signed-provider flows, not full in-memory buffering.

Acceptance criteria

• Oversized declared and chunked bodies return 413.
• Boundary-size valid bodies succeed.
• Malformed JSON remains a distinct safe 400 response.
• Endpoint overrides cannot exceed the documented hard ceiling without explicit review.
• Unit/integration tests cover JSON, text, missing length, false length, and aborted streams.
• Proxy and application defaults are documented and consistent.