Add HTTP size limits

docs/internal/adapters.md

@@ -88,6 +88,9 @@ Primary app settings consumed by adapters:
 - `schema_dir`
 - `server.addr`
 - `server.artifact_root` (HTTP `serve` file input root)
+- `server.max_request_bytes`
+- `server.max_artifact_bytes`
+- `server.max_response_bytes`
 - `defaults.render_format`
 
 Execution profile/request settings used through runner:
@@ -122,6 +125,7 @@ Artifact refs:
 - Unsupported types return `ErrUnsupportedRefType`.
 - CLI `run` and `render` use direct filesystem file reads for `file` references.
 - HTTP `serve` uses a restricted artifact reader: `inline` references work without a root, while `file` references require `server.artifact_root` or `--artifact-root` and must stay inside that root.
+- HTTP `serve` applies request-body, file-artifact, and encoded-response size limits. CLI `run` and `render` do not use these HTTP limits.
 - HTTP file paths are resolved with clean absolute paths and containment checks, not string-prefix checks.
 - Symlinks inside the root are followed by the operating system; the configured root must not be writable by untrusted users.
 
@@ -149,6 +153,7 @@ Validator:
 HTTP error mapping:
 
 - maps domain/use-case errors to stable HTTP code + error code/message.
+- maps request, artifact, and response size failures to `413` errors.
 - distinguishes missing profile selection and missing `api_key_env` variable using stable use-case sentinel errors.
 - avoids returning internal wrapped-cause details in response payload.