security(api): bound decode and batch-observation request bodies before JSON parsing #334

Context

Identified by a static comparison on 2026-10-07 against dborup/CoreScope master 6444294d938083f6d935d0445c27bc6a7bbf360e. This is follow-up work for evaluation and implementation, not a claim of an observed production incident. Recheck current master before implementation. No deployment is authorized by this issue alone.

Upstream reference: Kpa-clawbot fork, PR 2119 (reference only; intentionally not linked to avoid upstream notifications)

Benefit and existing coverage

Bound per-request memory use on POST /api/decode and POST /api/packets/observations. Both handlers currently decode JSON without an HTTP body cap. The existing 200-hash limit runs after parsing, so it is not a byte limit. Other handlers already use MaxBytesReader; reuse that established approach.

Required work / acceptance criteria

• Apply body limits before parsing; evaluate upstream's 4 KiB decode and 64 KiB batch limits against legitimate clients.
• Return a documented HTTP 413 for oversized parsed bodies, with consistent JSON errors.
• Test exact boundaries, oversized unknown fields, chunked/unknown-length requests, malformed JSON and normal requests.
• Preserve the existing 200-hash limit and decode behavior.
• Do not rely solely on reverse-proxy limits; verify the application directly.

Keep this separate from node-list cardinality and Reach concurrency limits.