fix(backend): report ingest correctness — propagate storage failure, 413 on oversize, global body cap (closes #23)

A buffer failure on POST /api/v1/reports now returns 500 instead of a
false {"status":"ok"}, so clients can retry. Decode errors are split:
an over-limit body returns 413 (via errors.As on *http.MaxBytesError),
malformed JSON stays 400. A new MaxBodyBytes middleware caps every
route (1 MiB default; rejects an oversized Content-Length up-front and
caps the read otherwise), replacing the per-route reader so the health
check and future routes are bounded too. The raw attacker-controlled
geo blob is no longer logged — only its byte length — and client_id and
timestamp are length-bounded before logging. A decodeJSON handler helper
is added per the HTTP server conventions. Panic recovery is now a local
middleware that routes the stack through slog as structured JSON rather
than chi's plain-text stderr. Error bodies still leak nothing internal.

Chosen failure code for a storage failure: 500, since a full buffer or
write error is server-side and retryable, not the client's fault.

Model: opus-4-8

TODO.md

@@ -22,6 +22,13 @@ files, so merging it also closes most compliance gaps.
 
 # Completed Steps
 
+- 2026-09-21: report ingest correctness (issue #23): a storage failure now
+  returns 500 instead of a false `ok`; oversize bodies return 413 (distinguished
+  from malformed JSON, which stays 400); a `MaxBodyBytes` middleware caps every
+  route, not just the report route; the raw attacker-controlled `geo` blob is no
+  longer logged (only its length) and `client_id`/`timestamp` are length-bounded
+  before logging; a `decodeJSON` handler helper was added; and panic recovery
+  now routes the stack through slog instead of chi's plain-text stderr
 - 2026-09-21: backend HTTP hardening (issue #19): added `ReadHeaderTimeout` and
   `IdleTimeout` to the server, a `SecurityHeaders` middleware (HSTS, tight CSP,
   frame/sniff/referrer/permissions headers) registered before CORS, and