[lijiashu1]

Summary

• Cap incoming JSON request bodies at 1 MiB to prevent unbounded buffering from exhausting server memory.
• Return a safe 413 REQUEST_TOO_LARGE response for oversized requests without exposing internal error details.
• Add an integration regression test for oversized anonymous-auth requests.

Validation

• Added a regression test; GitHub Actions will run syntax checks and npm test.