fix: enforce API request limits

Add a single platform-owned request-body policy (hono/body-limit) with
small, named limits for Better Auth and Core's grant-mutation endpoint, and
a new required maxBodyBytes field on the executable module route contract so
every module route makes a conscious no-body-or-bounded-body choice, capped
at a platform ceiling. Every oversized request gets one sanitized 413
contract and never reaches business logic, authorization, or a handler.
Also configure finite Node header/request/keep-alive timeouts, including the
non-obvious connectionsCheckingInterval needed for them to take effect
promptly, so a slow-header or slow-body connection cannot hold a socket
indefinitely.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

packages/module-sdk/tests/define-module-runtime.test.ts

@@ -48,6 +48,7 @@ describe("defineModuleRuntime", () => {
           method: "GET",
           path: "/records",
           permission: "example.records.read",
+          maxBodyBytes: 0,
           handler: () => new Response(null, { status: 204 }),
         });
       },