Apply MAX_MESSAGE_SIZE to the whole request body (closes #250)

Creating a session, logging in and posting a message stopped reading
after the first JSON value, so the limit never saw the rest of the
body and trailing bytes were ignored. All three now read the whole
limited body and decode it with json.Unmarshal. A body over the limit,
or anything but whitespace after the value, gets 400 invalid request
body.

Model: opus-5-5

internal/handlers/auth.go

@@ -1,7 +1,6 @@
 package handlers
 
 import (
-	"encoding/json"
 	"net/http"
 	"strings"
 
@@ -55,7 +54,7 @@ func (hdlr *Handlers) handleLogin(
 
 	var payload loginRequest
 
-	err := json.NewDecoder(request.Body).Decode(&payload)
+	err := decodeJSON(request, &payload)
 	if err != nil {
 		hdlr.respondError(
 			writer, request,