feat(api): make request body-size limit declarative in the route registry

[krisarmstrong]

stem's capability registry already made HTTP methods authoritative
(methods + methodGate); the body-size cap was the one piece of route
policy still living outside it — every handler relied on decodeJSONStrict
passing maxRequestBodySize per call site, so a route that forgot to decode
strictly had no body cap. This brings stem to seed parity (ADR-0002): the
registry is the single authoritative source for body limits too.

• Add maxBodyBytes to the route struct (0 => default maxRequestBodySize).
• Add bodyLimited middleware, composed innermost in register() so r.Body
  is capped before the handler reads (order: rateLimit → auth → methodGate
  → bodyLimit → handler).
• Expose maxBodyBytes in the /__capabilities manifest (routePolicyView).
• Assert in TestRoutePolicyManifest that every route records a non-zero
  body limit, so no route can ship with an uncapped body.

Safe to default-cap: stem has no multipart/upload routes — every body
path already goes through decodeJSONStrict at maxRequestBodySize (1 MB),
so the registry cap matches what was enforced inline. The existing inline
decode caps remain as defense-in-depth.

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 31 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)