[rd-code-23]

Summary

Makes Express's JSON request limit explicit and returns accurate client errors for malformed or oversized request bodies.

This PR intentionally does not add arbitrary maximum lengths to every text field or PostgreSQL column. The overall request limit addresses the payload-size security concern; field limits remain product decisions.

Closes #69.

What changed

• Configured express.json() with an explicit 100 KB limit.
• Added 400 invalid_json handling for malformed JSON.
• Added 413 request_too_large handling for oversized JSON.
• Preserved the existing safe 500 internal_server_error response for unexpected failures.
• Extracted the existing 100-character exercise-name limit into a named constant.
• Applied the name limit to both exercise input and response validation.
• Added focused request-parsing and contract tests.

Why both request and name limits remain

The 100 KB request limit protects the server from unusually large JSON payloads across current and future endpoints.

The exercise-name limit is a separate product rule: names are short labels displayed throughout the UI. Descriptions remain unrestricted strings, and the PostgreSQL columns remain text. We are not establishing a blanket rule that every text field needs a database length constraint.

Error behavior

• Malformed JSON: 400 { "error": "invalid_json" }
• JSON larger than 100 KB: 413 { "error": "request_too_large" }
• Unexpected application failure: 500 { "error": "internal_server_error" }

Verification

• Type-checking passed.
• ESLint passed.
• All 83 tests passed.
• Changed files pass Prettier.

Out of scope

• Rate limiting
• Per-endpoint body-size limits
• Arbitrary description or database text limits
• Database migrations