fix: enforce API request limits

Add a single platform-owned request-body policy (hono/body-limit) with
small, named limits for Better Auth and Core's grant-mutation endpoint, and
a new required maxBodyBytes field on the executable module route contract so
every module route makes a conscious no-body-or-bounded-body choice, capped
at a platform ceiling. Every oversized request gets one sanitized 413
contract and never reaches business logic, authorization, or a handler.
Also configure finite Node header/request/keep-alive timeouts, including the
non-obvious connectionsCheckingInterval needed for them to take effect
promptly, so a slow-header or slow-body connection cannot hold a socket
indefinitely.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

core/tests/fixtures/module-database-integration/db-facade/server/index.js

@@ -37,6 +37,7 @@ export default {
       method: "GET",
       path: "/records/:id",
       permission: "db-facade.records.read",
+      maxBodyBytes: 0,
       async handler(_request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -62,6 +63,7 @@ export default {
       // fixture's one authenticated-baseline GET route, used to prove HEAD cannot bypass
       // authorization the way it could if HEAD skipped the same middleware chain GET uses.
       permission: "db-facade.records.write",
+      maxBodyBytes: 0,
       async handler(_request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -81,6 +83,7 @@ export default {
       method: "POST",
       path: "/records",
       permission: "db-facade.records.write",
+      maxBodyBytes: 1024,
       async handler(request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -98,6 +101,7 @@ export default {
       method: "PATCH",
       path: "/records/:id",
       permission: "db-facade.records.write",
+      maxBodyBytes: 1024,
       async handler(request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -122,6 +126,7 @@ export default {
       method: "POST",
       path: "/records/transactional",
       permission: "db-facade.records.write",
+      maxBodyBytes: 1024,
       async handler(request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -152,6 +157,7 @@ export default {
       method: "GET",
       path: "/boom",
       permission: "db-facade.records.read",
+      maxBodyBytes: 0,
       async handler(_request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),
@@ -170,6 +176,7 @@ export default {
       method: "GET",
       path: "/safe-boom",
       permission: "db-facade.records.read",
+      maxBodyBytes: 0,
       async handler(_request, context) {
         recordEvent({
           contextKeys: Object.keys(context).sort(),