Add HTTP size limits

docs/integrations/http-api.md

@@ -75,6 +75,8 @@ Relative file URIs resolve inside that root. Absolute file URIs are accepted
 only when they remain inside the root. Requests that escape the root, including
 `..` traversal and absolute paths outside the root, return
 `400 artifact_not_allowed`. `inline` references do not require an artifact root.
+HTTP file artifacts above the configured artifact limit return
+`413 artifact_too_large`. Inline bodies are bounded by the request body limit.
 
 Model override notes:
 
@@ -91,6 +93,8 @@ Request decoding uses strict JSON field checks:
 - unknown request fields are rejected with `400 invalid_json`
 - unknown `model` fields are rejected with `400 invalid_json`
 - raw API-key payload fields such as `api_key` are rejected as unknown fields
+- request bodies above the configured request limit are rejected with `413 request_too_large`
+- trailing JSON tokens after the request object are rejected with `400 invalid_json`
 
 ## Success Response
 
@@ -204,6 +208,9 @@ Current error mapping (non-exhaustive):
 - `400 artifact_read_failed`: input artifact loading failed
 - `400 prompt_render_failed`: template render failed
 - `400 api_key_env_missing`: named API-key environment variable is missing
+- `413 request_too_large`: request body exceeds the configured request limit
+- `413 artifact_too_large`: HTTP file input artifact exceeds the configured artifact limit
+- `413 response_too_large`: encoded JSON response exceeds the configured response limit
 - `404 prompt_not_found`
 - `404 profile_not_found`
 - `502 llm_failed`: outbound model request failed