fix(server): add request body size limit to the API server

[aheritier]

Summary

pkg/server/server.go NewWithManager registers RedactedRequestLogger + optional bearer middleware only; handlers JSON-decode unbounded bodies (e.g. runAgent, server.go:444). By contrast pkg/chatserver/server.go:220 sets middleware.BodyLimit. Default bind is loopback and auth is optional, but any local process can OOM the agent — worse if bound non-loopback.

Fix

Add BodyLimit middleware mirroring chatserver.

Acceptance

• Oversized request body → 413; middleware test.