Add WithMaxResponseBody option to prevent client-side OOM

Wraps response body with io.LimitedReader when configured, preventing
unbounded reads from io.ReadAll in Response.Bytes(). Protects against
upstream services returning unexpectedly large responses.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

response_limit_test.go

@@ -0,0 +1,76 @@
+package httpx_test
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.codelab.vc/pkg/httpx"
+)
+
+func TestClient_MaxResponseBody(t *testing.T) {
+	t.Run("allows response within limit", func(t *testing.T) {
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			fmt.Fprint(w, "hello")
+		}))
+		defer srv.Close()
+
+		client := httpx.New(httpx.WithMaxResponseBody(1024))
+		resp, err := client.Get(context.Background(), srv.URL+"/")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		body, err := resp.String()
+		if err != nil {
+			t.Fatalf("reading body: %v", err)
+		}
+		if body != "hello" {
+			t.Fatalf("body = %q, want %q", body, "hello")
+		}
+	})
+
+	t.Run("truncates response exceeding limit", func(t *testing.T) {
+		largeBody := strings.Repeat("x", 1000)
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			fmt.Fprint(w, largeBody)
+		}))
+		defer srv.Close()
+
+		client := httpx.New(httpx.WithMaxResponseBody(100))
+		resp, err := client.Get(context.Background(), srv.URL+"/")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		b, err := resp.Bytes()
+		if err != nil {
+			t.Fatalf("reading body: %v", err)
+		}
+		if len(b) != 100 {
+			t.Fatalf("body length = %d, want %d", len(b), 100)
+		}
+	})
+
+	t.Run("no limit when zero", func(t *testing.T) {
+		largeBody := strings.Repeat("x", 10000)
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			fmt.Fprint(w, largeBody)
+		}))
+		defer srv.Close()
+
+		client := httpx.New()
+		resp, err := client.Get(context.Background(), srv.URL+"/")
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		b, err := resp.Bytes()
+		if err != nil {
+			t.Fatalf("reading body: %v", err)
+		}
+		if len(b) != 10000 {
+			t.Fatalf("body length = %d, want %d", len(b), 10000)
+		}
+	})
+}