Server: make express.json() body-size limit explicit + env-tunable

[CryptoJones]

express.json() defaults to a 100kb body limit. The call site doesn't make that explicit, and there's no env override — so a deployment that needs to accept larger payloads has to fork the server file. Make it explicit and add JSON_BODY_LIMIT env knob.

Test coverage: a 413 PayloadTooLarge test for oversized bodies and a passing test for small bodies.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/