feat(api): add request size protection middleware (#688)

[ravendevhub]

Summary

Resolves #688 by introducing an API request size protection middleware (listener/src/api/request-size-limiter.ts) that enforces configurable byte limits on incoming payloads, fast-rejects oversized Content-Length headers, and pauses/destroys streaming data to prevent memory exhaustion and DoS attacks.

Changes

1. Request Size Limiter Middleware (listener/src/api/request-size-limiter.ts):
   • Inspects Content-Length headers and incoming stream chunks against maxSizeBytes.
   • Returns structured HTTP 413 PAYLOAD_TOO_LARGE error responses.
   • Cleans up event listeners and pauses input stream to prevent memory buffering.
2. Automated Unit Tests (listener/src/api/request-size-limiter.test.ts):
   • Tests within-limit requests, oversized header rejections, and streaming chunk overflows.
3. Documentation (docs/REQUEST_SIZE_PROTECTION.md):
   • Documents threat model, configuration options, and error schemas.

Acceptance Criteria

• A configurable request-size limit exists.
• Oversized requests receive an appropriate error.
• The server does not attempt to process rejected payloads.
• Tests cover boundary conditions.