feat(security): add request size limits to API endpoints

- Add RequestSizeLimitMiddleware that checks Content-Length header
  before request body is read: non-multipart requests capped at
  MAX_REQUEST_BODY_SIZE (default 1 MB), multipart uploads capped at
  MAX_UPLOAD_SIZE (default 1 GB). Returns HTTP 413 on violation.
- Register middleware in app/main.py
- Add max_request_body_size setting to app/config.py
- Fix ui_upload in files.py to check Content-Length early and read
  in 64 KB chunks (bounded memory usage), removing the post-write
  os.path.getsize check
- Document MAX_REQUEST_BODY_SIZE in .env.demo and ConfigurationGuide.md
- Mark SECURITY_AUDIT.md item #4 as resolved
- Add 9 tests in test_request_size_limit.py
- Update test_upload_file_too_large to use patch.object instead of
  the now-unused os.path.getsize mock

Closes #173

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.env.demo

@@ -21,6 +21,12 @@ MAX_UPLOAD_SIZE=1073741824
 # Default: None (no splitting). Example: 104857600 for 100MB chunks
 # MAX_SINGLE_FILE_SIZE=104857600
 
+# **Request Body Size Limit** (Security - see SECURITY_AUDIT.md)
+# Maximum request body size in bytes for non-file-upload requests (JSON, form data, etc.).
+# Default: 1MB (1048576 bytes). File uploads are governed by MAX_UPLOAD_SIZE above.
+# Prevents memory exhaustion from oversized JSON/form payloads.
+# MAX_REQUEST_BODY_SIZE=1048576
+
 # **Security Headers** (see SECURITY_AUDIT.md and docs/DeploymentGuide.md)
 # Disabled by default since most deployments use a reverse proxy (Traefik, Nginx, etc.)
 # that already adds these headers. Set to true only if deploying directly without a reverse proxy.