No anonymous request can make the forge read an unbounded body #698

Pillar: trust (umbrella #586). One run, from today's main.

Outcome. No anonymous request can make the forge read an unbounded body.

Today. Routes open to strangers check content-length, but a body sent without one is read anyway, and the server sets no maximum request body size, so the runtime default (128 MB) applies to every route.

Acceptance.

• [ ] Bun.serve sets maxRequestBodySize to a deliberate forge-wide value, with git smart-HTTP pushes (which need more) handled explicitly.
• [ ] Anonymous JSON and form routes read their body through one bounded reader that stops at the route's cap whether or not a length was declared, and answer 413.
• [ ] Tests: a declared oversize body and an undeclared oversize body are both refused on the report and OAuth registration routes; a large authenticated push still works.

Done means reachable: test, and the cap named in docs/ARCHITECTURE.md.

Two facts from #705 for this issue, so the run settles them:

• boundedBody (src/http/respond.ts, used by the anonymous MCP path and POST …/reports) stops keeping bytes past its limit but keeps reading to the end of the body and drops what it reads. Without a server-wide maximum, a chunked body that never ends is read until the idle timeout.
• Cancelling the read instead was tried and is worse: the rest of the body stays on the connection, and the next request on that keep-alive connection was answered with a bare 400 (seen in a test with Bun as the client; behind a reusing proxy that 400 could go to another person). A connection: close header on the 413 did not reliably stop it.

So the settled shape should be: a hard maxRequestBodySize on Bun.serve (git smart-HTTP handled explicitly), and after an over-limit body the connection is closed once the response is sent, with a test that a request sent after an over-limit chunked one on the same connection is answered correctly. The web report form (reportSubmit) still checks only content-length and should move to the same reader.