fix(backend): report ingest correctness — propagate storage failure, 413 on oversize, global body cap (closes #23)

A buffer failure on POST /api/v1/reports now returns 500 instead of a
false `ok`: the failure is server-side and a client can retry. An
over-limit body returns 413 (errors.As on `*http.MaxBytesError`);
malformed JSON stays 400. A MaxBodyBytes middleware (1 MiB) caps every
route; a route group can only lower that limit. The raw geo blob is no
longer logged, only its length; client_id, timestamp and decode error
text are length-bounded before logging. A decodeJSON handler helper is
added. Panic recovery routes the stack through slog as structured
JSON. Writing a report file now returns its error, so a failed final
flush fails the stop and the process exits non-zero.

Model: opus-5-5

TODO.md

@@ -23,6 +23,16 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-09-28: report ingest correctness (issue #23): a storage failure now
+  returns 500 instead of a false `ok`; oversize bodies return 413 (distinguished
+  from malformed JSON, which stays 400); a `MaxBodyBytes` middleware caps every
+  route, not just the report route; the raw attacker-controlled `geo` blob is no
+  longer logged (only its length), and `client_id`, `timestamp` and decode error
+  text are length-bounded before logging; a `decodeJSON` handler helper was
+  added; panic recovery now routes the stack through slog instead of chi's
+  plain-text stderr; and writing a report file now returns its error, so a
+  failed final flush on shutdown makes the process exit non-zero instead of
+  losing the buffered reports silently
 - 2026-09-21: shutdown lifecycle correctness. The process now shuts down through
   fx instead of `os.Exit`, so every component's `OnStop` runs and buffered
   reports are flushed to disk on `SIGTERM` — previously a full flush window of