Say at the receiver route where its 1 MB body cap lives (closes #173)

The receiver route /h/{uuid} has no MaxBodySize middleware, unlike the page route groups; its 1 MB cap is enforced in the handler, which owns the response senders see. Nothing at the route said so, so a reader could take the receiver for uncapped or remove the only bound on the one unauthenticated endpoint. The route registration and the handler's body-reading function now say where the cap lives and why. A routing test sends a body of exactly 1 MB and one a byte over through the production router and pins that only the second is refused, with the handler's 413 and message.

Model: opus-5-5

internal/server/routes.go

@@ -324,6 +324,12 @@ func (s *Server) setupSourceRoutes() {
 }
 
 func (s *Server) setupWebhookRoutes() {
+	// No MaxBodySize here, unlike the page groups. The receiver's 1 MB
+	// body cap is in Handlers.readWebhookBody, because the handler
+	// owns the response a sender gets for an oversized body and
+	// MaxBodySize would change it. That cap is the only bound on this
+	// unauthenticated endpoint's body; TestReceiver_OversizeBodyRefused
+	// pins it.
 	s.router.With(s.mw.ReceiverRateLimit()).HandleFunc(
 		"/h/{uuid}",
 		s.h.HandleWebhook(),