enforce 5 MB default file-size limit on get_component_file

[kriszyp]

Closes #600.

Summary

• get_component_file now refuses files larger than a configurable limit, returning HTTP 413 with a clear error message.
• Default limit: 5 MB (5 * 1024 * 1024 bytes).
• Operators can override via operationsApi.componentFile.maxSize (bytes) in harperdb-config.yaml.

Changes

• components/operations.js — read config value, validate it (guard against non-numeric), check stats.size before readFile; compute file path once (DRY)
• utility/errors/commonErrors.ts — add CONTENT_TOO_LARGE: 413 status code; add COMPONENT_FILE_TOO_LARGE error message
• utility/hdbTerms.ts — add OPERATIONSAPI_COMPONENTFILE_MAXSIZE config param
• config-root.schema.json — document operationsApi.componentFile.maxSize
• unitTests/server/fastifyRoutes/operations.test.js — add test for the 413 rejection path

Notes for reviewer

• Cross-model review (Codex + Gemini) raised a TOCTOU concern (stat then readFile race). Risk is low here — component directories are admin-controlled — but worth a follow-up hardening issue if desired.
• Path traversal via project is a pre-existing gap in getComponentFileValidator (not introduced here); flagged separately.

Generated by Claude Sonnet 4.6.

[claude]

Reviewed; no blockers found.