fix(app-server): enforce body limit on actual bytes

[OnlyYu1996]

Summary

• Read request bodies through axum's byte limiter before forwarding to handlers.
• Return 413 when the streamed body exceeds max_body_size, even without a Content-Length header.
• Rebuild the request with the bounded body so downstream handlers keep their existing extraction behavior.
• Add regression coverage for streaming bodies with no Content-Length, both under and over the configured limit.

Fixes PlatformNetwork/bounty-challenge#53239

Verification

• cargo fmt --package cortex-app-server --check
• cargo test --package cortex-app-server body_limit -- --nocapture
• cargo test --package cortex-app-server middleware::tests -- --nocapture
• cargo check --package cortex-app-server --lib
• git diff --check

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.