fix(http): stop reading request bodies of up to 512 MB before authentication

Next reads the body of every non-GET request the proxy matches into
memory before the route runs. The ceiling was 512 MB so the Apple Health
importer could receive whole archives, which let any anonymous POST to any
API path make the server hold that much.

The ceiling is now 1 MB (proxyClientMaxBodySize). The fifteen routes whose
real bodies are larger are left out of the proxy matcher and read their
own body after authenticating; apiHandler gives them the proxy's refusals
(worker-only, demo mode), security headers and a CSP. safeJson now counts
bytes while it reads and stops at its cap instead of reading everything
first, the CSV and dose-history imports do the same, and a multipart
backup upload is counted while it is read. A test compiles the matcher the way
Next does and checks it skips exactly the listed routes and every route
with a larger body is listed.

Local lab OCR runs its WebAssembly engine in a worker served from
/tesseract/. Those responses, and the /labs and /documents pages that start
the OCR, now carry 'wasm-unsafe-eval' in script-src; no other route does.

src/app/api/import/csv/route.ts

@@ -2,7 +2,12 @@ import { prisma } from "@/lib/db";
 import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
-import { apiSuccess, apiError, getClientIp } from "@/lib/api-response";
+import {
+  apiSuccess,
+  apiError,
+  getClientIp,
+  readBodyText,
+} from "@/lib/api-response";
 import { encryptNote } from "@/lib/crypto/note-cipher";
 import { checkRateLimit } from "@/lib/rate-limit";
 import { NextRequest } from "next/server";
@@ -68,15 +73,16 @@ export const POST = apiHandler(async (request: NextRequest) => {
   if (Number.isFinite(declaredLength) && declaredLength > MAX_CSV_BYTES) {
     return apiError("CSV exceeds the 16 MB limit", 413);
   }
+  // Counted while it is read, so a body without a Content-Length cannot run
+  // past the cap before the check.
   let text: string;
   try {
-    text = await request.text();
+    const read = await readBodyText(request, MAX_CSV_BYTES);
+    if (read.tooLarge) return apiError("CSV exceeds the 16 MB limit", 413);
+    text = read.text;
   } catch {
     return apiError("Could not read the request body", 400);
   }
-  if (Buffer.byteLength(text, "utf8") > MAX_CSV_BYTES) {
-    return apiError("CSV exceeds the 16 MB limit", 413);
-  }
 
   const parsed = parseCsvMeasurements(text);
   if (parsed.fatal) {