fix(inbound-api): resolve InboundAPI-002,004,006,008 — disconnect vs timeout, body size limit, active-node gate; surface InboundAPI-007

src/ScadaLink.InboundAPI/InboundApiOptions.cs

@@ -2,5 +2,19 @@ namespace ScadaLink.InboundAPI;
 
 public class InboundApiOptions
 {
+    /// <summary>
+    /// Default cap on the inbound API request body, in bytes (InboundAPI-006).
+    /// </summary>
+    public const long DefaultMaxRequestBodyBytes = 1L * 1024 * 1024; // 1 MiB
+
     public TimeSpan DefaultMethodTimeout { get; set; } = TimeSpan.FromSeconds(30);
+
+    /// <summary>
+    /// InboundAPI-006: maximum accepted request body size for <c>POST /api/{methodName}</c>.
+    /// Requests whose body exceeds this are rejected with HTTP 413 before being
+    /// buffered into a <see cref="System.Text.Json.JsonDocument"/>. The inbound API
+    /// has no rate limiting (a deliberate design choice), so an explicit, modest cap
+    /// bounds per-request allocations.
+    /// </summary>
+    public long MaxRequestBodyBytes { get; set; } = DefaultMaxRequestBodyBytes;
 }