fix: enforce API request limits

Add a single platform-owned request-body policy (hono/body-limit) with
small, named limits for Better Auth and Core's grant-mutation endpoint, and
a new required maxBodyBytes field on the executable module route contract so
every module route makes a conscious no-body-or-bounded-body choice, capped
at a platform ceiling. Every oversized request gets one sanitized 413
contract and never reaches business logic, authorization, or a handler.
Also configure finite Node header/request/keep-alive timeouts, including the
non-obvious connectionsCheckingInterval needed for them to take effect
promptly, so a slow-header or slow-body connection cannot hold a socket
indefinitely.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

templates/module/src/server/index.ts

@@ -21,6 +21,12 @@ export default defineModuleRuntime({
       method: "GET",
       path: "/records",
       permission: "example.records.read",
+      // This route accepts no request body at all — a GET route never should. Every route must
+      // make this choice consciously: 0 means "no body accepted" (a non-empty declared or streamed
+      // body is rejected before this handler ever runs); a route that does accept a body declares
+      // its own explicit byte maximum instead, up to the platform's ceiling
+      // (`MODULE_ROUTE_MAX_BODY_BYTES_CEILING`, `@ekklesia/contracts`).
+      maxBodyBytes: 0,
       async handler(_request, context) {
         const rows = await context.services.database
           .select({ id: records.id, value: records.value })

templates/module/tests/manifest.test.ts

@@ -106,6 +106,9 @@ describe("module template", () => {
       method: "GET",
       path: "/records",
       permission: "example.records.read",
+      // The template's example route demonstrates the explicit no-body contract: a GET route
+      // accepts no request body at all.
+      maxBodyBytes: 0,
     });
   });