Accept a chunked upstream body of exactly the maximum size (closes #248)

Once MaxResponseSize bytes were read, limitedReader.Read refused the
next read without looking for the end of the body. A body sent with a
Content-Length gets io.EOF with its last bytes, but the end of a
chunked body can come in a later read, so a chunked body of exactly
the limit was refused. Once the limit is used up, Read now reads one
more byte: at the end of the body it returns io.EOF, and with more
data it returns ErrResponseTooLarge, as does every later Read.

Model: opus-5-5

TODO.md

@@ -30,6 +30,15 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 a chunked upstream body of exactly `upstream_max_response_size`
+  bytes is accepted (closes #248): once the limit was used up, the fetcher's
+  next read refused the body without looking for its end. Go's HTTP client
+  returns the end of a body sent with a `Content-Length` together with its last
+  bytes, but the end of a chunked body can come in a later read, so such a body
+  was refused after it had been downloaded whole, and the image routes
+  answered 500. Once the limit is used up, the fetcher now reads one more byte:
+  if the body has ended it is accepted, and if there is more it is refused with
+  `ErrResponseTooLarge`, as before.
 - 2026-10-13 `fit=outside` no longer makes an output above 8192 on a side
   (closes #257): it scales the image to cover the requested size, and the side
   scaled past that size was held to no maximum, so `1x8192?fit=outside` of a