Fix/json body limit and jwt exp validation

[Litezy]

Closes #826
Closes #827

Summary

• Set an explicit 1mb limit on express.json() in app.ts — documents
  intent and caps the JSON-parse DoS surface (was silently defaulting to 100 kb).
• Guard payload.exp in verifyJwt with a typeof check before the
  numeric comparison — previously a signature-valid token with no exp field
  evaluated undefined < number → false and was accepted forever.

[ogazboiz]

heads up: main's ci was broken (the Backend CI and Backend Docker Image CI jobs) until the fixes in #969 and #974 just landed, so the red backend/docker checks on this pr are almost certainly stale, they ran against the broken main. please rebase to re-test against the now-green main: git fetch origin && git rebase origin/main && git push --force-with-lease. once it's green i'll review and merge. (if a non-backend check like Frontend CI is still red after the rebase, that part is a real issue worth a look, since frontend ci was passing on main.)