[SandObserver]

Summary

• Add AUTH_BODY_LIMIT (32 KB) in api/src/router.js and let readBody take a per-route limit.
• Read the login, set-password and toggle bodies with AUTH_BODY_LIMIT instead of the general 2 MB limit. An oversized body gets 400 from the API.
• Add an nginx location ^~ /api/auth/ with client_max_body_size 32k, so oversized auth bodies get 413 before they reach the API.

Testing
All green. Added 5 tests: an oversized body on login, set-password and toggle gets 400, the largest real body still fits, and the nginx limit matches AUTH_BODY_LIMIT.

Changelog

Security

• Refuse sign-in and password requests larger than 32 KB, so parallel large requests to these routes can no longer exhaust the container's memory.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.