[dlpwaters]

Summary

• reduce the maximum buffered API response from 64 MiB to 4 MiB and reject oversized Content-Length before reading
• add endpoint-specific collection ceilings and text-field bounds
• project server records onto explicit UI allowlists before aggregation or serialization
• cap total helper output to 1 MiB before it reaches QML's StdioCollector
• add regressions for oversized collections and bounded long-lived shell fields

Verification

• all 57 tests pass, including both real loopback authentication integration tests
• omarchy plugin validate .
• qmllint passes
• Python compile and JSON validation pass
• git diff --check

Marketplace submission: omacom/omarchy-plugin-marketplace#1497