Failing test first for the per-route body limit. The key regression:
an oversized POST / or POST /generate carrying an otherwise valid CSRF
cookie and token must return 413. CSRF landed on next and reads its token
from the form body, so if the limit ran after CSRF the truncated body
would read as a missing token (403) and if it ran after the handler a
valid token would succeed (303). 413 proves the limit fires first. Two
within-limit tests guard against the limit disturbing a normal request.
Model: opus-4-8
sneak
c53e53b7b1