feat(api): make maximum request body size configurable

[aheritier]

Problem

serve api currently applies a hardcoded 1 MiB middleware.BodyLimit. Legitimate large POST /api/sessions/:id/messages requests can therefore fail with HTTP 413.

The chat server already provides a configurable --max-request-size precedent.

Proposal

Add an equivalent configurable API-server request-size option, while retaining 1 MiB as the secure default. Apply the limit consistently to API routes, document the default and units, explain the HTTP 413 behavior, and preserve a finite maximum rather than allowing an unlimited request body.

This is separate from normalization of consecutive user messages.

Acceptance criteria

• serve api exposes a configurable maximum request-body size with documented units.
• The default remains 1 MiB.
• The configured finite limit is applied consistently to API routes, including POST /api/sessions/:id/messages.
• Requests exceeding the configured limit return HTTP 413.
• Documentation describes the option, default, units, and 413 behavior.
• The implementation includes coverage for the default, configured limit, and oversized-request behavior.
• No changes are made to consecutive-user-message normalization.