feat(mcp): cap inbound request body at 1 MiB

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/mcp/server.go

@@ -8,7 +8,10 @@ import (
 	"gitea.d-ma.be/mathias/gitea-mcp/internal/registry"
 )
 
-const ProtocolVersion = "2025-06-18"
+const (
+	ProtocolVersion    = "2025-06-18"
+	maxRequestBodyBytes = 1 << 20 // 1 MiB
+)
 
 type ServerOptions struct {
 	Registry *registry.Registry
@@ -38,6 +41,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Server) handlePOST(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBodyBytes) // 1 MiB cap
 	var req Request
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeJSON(w, http.StatusBadRequest, NewErrorResponse(nil, -32700, "parse error", nil))