chore: backport security improvements from audit

[amrtgaber]

Summary

Backports template-level fixes discovered during a security / analytics / legal audit across projects spawned from this template. Full plan in BACKPORT_FROM_AUDIT.md (templates root).

Changes

Security

• feat: 1MB request body size middleware in app/main.py. FastAPI/Starlette enforces no default limit, so without this a malicious client could POST a multi-GB JSON payload and the server would happily try to parse it. Returns HTTP 413 when Content-Length exceeds the threshold.
• feat(schemas): add Field(max_length=...) bounds to user-supplied strings.
  • NoteBase.body → 10,000 chars (was unbounded)
  • UserCreate.name / UserUpdate.name → 100 chars (were unbounded)
  • UserRead.name intentionally left unbounded (response shape, data originates from our DB)
  • Demonstrates the pattern so new projects copy it.

Observability

• feat(logging): bind user_id to structlog contextvars on authentication. Wraps the fastapi-users current_active_user and current_superuser dependencies transparently so every log emitted during an authenticated request carries user_id alongside the existing request_id. No caller changes required — the wrapping happens at the symbol level in app/auth/users.py and FastAPI's DI chain handles the rest.

Scaffolding

• chore: add top-level permissions: contents: read to .github/workflows/ci.yml (least-privilege GITHUB_TOKEN).
• chore: add .github/CODEOWNERS catch-all placeholder (* @amrtgaber) so spawned projects get review enforcement from day one.

Test plan

• uv run ruff check . — clean
• uv run ruff format --check . — clean
• uv run pytest — 21/21 passing
• Manual: POST a request with Content-Length: 2000000 and verify 413 response
• Manual: authenticated request and verify user_id appears in structured log output alongside request_id
• Manual: POST a note with a 20,000-char body and verify 422 validation error