Add request body size limit middleware function

[muzman123]

Problem

Issue #3054 identified that the API does not enforce request body size limits

Solution

Added requestBodySizeLimitMiddleware in pkg/api/server.go that:

• Enforces a 1MB default limit via maxRequestBodySize constant
• Returns HTTP 413 Request Entity Too Large for oversized requests
• Checks Content-Length header for immediate rejection (efficient)
• Uses http.MaxBytesReader as safety net for chunked/streaming requests

Added unit tests in pkg/api/request_size_test.go:

• ✅ Requests under limit succeed
• ✅ Requests at limit succeed
• ✅ Requests over limit return 413

Related Issue

Fixes #3054

[codecov]

Codecov Report

❌ Patch coverage is 72.72727% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.12%. Comparing base (262e711) to head (c4bc14c).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/api/server.go	72.72%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3114   +/-   ##
=======================================
  Coverage   57.11%   57.12%           
=======================================
  Files         341      341           
  Lines       33950    33961   +11     
=======================================
+ Hits        19392    19400    +8     
- Misses      12949    12951    +2     
- Partials     1609     1610    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds request body size limit middleware to the ToolHive API server to address security issue #3054 by preventing resource exhaustion from oversized request payloads. The implementation enforces a 1MB default limit with both early rejection via Content-Length header validation and a safety net using http.MaxBytesReader for chunked/streaming requests.

Key changes:

• Added requestBodySizeLimitMiddleware function that checks Content-Length and wraps request bodies with http.MaxBytesReader
• Integrated middleware into the API server's middleware chain before authentication
• Added comprehensive unit tests covering requests within limit, at limit, and exceeding limit

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
pkg/api/server.go	Defines 1MB constant, implements middleware function, and adds middleware to the request processing chain
pkg/api/request_size_test.go	Adds unit tests for middleware behavior with requests of various sizes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[eleftherias]

Thanks for the PR @muzman123! There are a few changes that Copilot suggested above. For the blank lines you can run task lint-fix to automatically fix them.

[eleftherias]

Thanks for the updates! I have a couple more questions and comments that I've left inline.

[eleftherias]

Looking at this again, let's remove this section. There is a larger issue in the codebase where errors are returned as plaintext, but we can deal with it separately.

Suggested change

	if strings.HasPrefix(r.URL.Path, "/api/") {
	w.Header().Set("Content-Type", "application/json")
	}

[eleftherias]

It would be nice to have a log message before the error is returned to help with diagnostics.

[eleftherias]

I'm concerned that if this fails, it won't return a 413 status code, and cause a different error. Do you have any thoughts around this?