security: reject oversized request bodies, document file attachments

[shrdgn]

What & why

• Server-side request body size limit. Nothing in the server previously bounded request body size — limits.py caps concurrency and rate (max_in_flight, rate_limit_per_minute, both off by default), but a single request of any size was read fully into memory via await request.json(). This matters more now that the playground's file-attachment feature (shipped in feat: file attachments + live panel progress counter in playground #107) sends multimodal payloads with base64-encoded file/image content — the UI enforces a 10 MB client-side cap, but nothing stops a direct API client from sending an arbitrarily large body and exhausting memory before the rate limiter even sees the request.
• Adds limits.max_request_bytes (off/unlimited by default, consistent with the other limits.py knobs) and server.py::MaxBodySizeMiddleware, which checks Content-Length against the cap and returns a clean 413 before the body is read, in the same OpenAI-compatible error shape as the rest of the API.
• Best-effort like the rest of limits.py: a client that omits Content-Length (chunked transfer-encoding) or lies about it isn't caught by this check — documented as a follow-up in docs/ARCHITECTURE.md's security table, same pattern used for the existing concurrency/rate-limit row.
• Docs: the file-attachment feature itself (paperclip button, 10 MB limit, supported types) was shipped but never mentioned in README's Playground section — added a short bullet documenting it while touching this area.

How it was tested

• ruff check . passes
• pytest -q passes (no live network) — 473 passed (was 469; 4 new tests: oversized body → 413 + upstream never called, request within limit passes, unlimited by default preserves current behavior, malformed Content-Length header falls through rather than raising)
• New behavior has a test (tests/test_limits.py)
• Docs updated (README "Production limits" + "Playground", docs/ARCHITECTURE.md security table, CHANGELOG.md, examples/preset.yaml.example)
• No secrets, prompts, or response bodies added to logs or metrics
• N/A — no quality/cost claim, nothing for bench/run.py
• mypy openfusion/ --ignore-missing-imports --disable-error-code import-untyped --exclude openfusion/cli.py — clean, 23 source files
• pytest --cov=openfusion — 99.53% overall, no regressions; new middleware fully covered

Notes for reviewers

• Default is 0 (unlimited), matching the existing "off by default" convention for max_in_flight/rate_limit_per_minute — this is opt-in for operators, not a behavior change out of the box.
• Only wired into the static app_config.limits path (same as RequestLimiter today); a config_resolver-based multi-tenant deployment doesn't get a per-tenant value here, consistent with how the existing rate/concurrency limits already work in that mode.
• Found via an automated repo-quality review; unrelated to the existing backlog of open PRs (chore(deps): bump actions/setup-node from 6 to 7 #108–fix: retry transient 429s on the judge synthesis call #112, fix: rebuild stale playground static assets, unbreak main CI #115, refactor: extract resetTurnState() from startNewConversation/switchConversation #117, test: cover error/edge-case branches in web/src/lib/api.ts #118, ci: cache pip dependencies in lint-and-test #120) covering CI caching, dependency bumps, mypy config, Docker healthcheck, judge retry, and frontend test coverage.

---

Generated by Claude Code