Wraps request body with http.MaxBytesReader to limit incoming payload
size. Without this, any endpoint accepting a body is vulnerable to
large uploads consuming all available memory.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
