fix: bound generated API client responses

[cloudcarver]

Summary

• cap buffered generated-client response bodies at 10 MiB
• return a stable overflow error after reading at most one byte beyond the limit
• give generated default clients a 30-second timeout
• preserve caller-provided HTTP clients
• add exact-limit, overflow, streaming, cancellation, and timeout tests

Validation

• go test ./...
• go test -race ./pkg/codegen/oapi ./pkg/zgen/apigen
• go vet ./...
• make gen

Closes #49