Add a configurable application-level request body limit

[lamenting-hawthorn]

Problem

TrueForge does not currently enforce an application-owned request-body size limit. Standalone or directly exposed deployments therefore depend on an external reverse proxy to reject oversized request bodies before JSON or binary parsing.

Proposed scope

• Add a configurable maximum request-body size with a documented default.
• Apply the limit consistently before API route parsing.
• Return a stable JSON 413 Payload Too Large error response.
• Document the environment variable in .env.example.
• Add tests for normal, boundary, oversized, and invalid-configuration cases.

Expected behavior

Normal requests remain unchanged. Requests over the configured byte limit fail early and consistently in standalone and multi-replica modes, regardless of reverse-proxy configuration.

Open design question

The default should be large enough for supported file-upload routes while still providing a meaningful application-level bound. It may be appropriate to align it with or exceed the existing sandbox file limit.

[lamenting-hawthorn]

This is now implemented and merged upstream.

• PR: feat: add max request body middleware #302 (feat: add max request body middleware, merged 2026-08-17)
• Commit: f0569732
• Behavior: configurable MAX_REQUEST_BODY_BYTES (documented default 30 MB, per packages/server/.env.example) via Hono bodyLimit; oversized requests get a stable JSON 413 Payload Too Large response; OpenAPI + generated SDK expose the new 413 error shape.

The full requested scope (configurable max, applied before route parsing, stable 413, documented env var) is covered. Suggest closing this issue; remaining item would be any documentation/quickstart mention, which I can add if wanted.