fix(http): stop reading request bodies of up to 512 MB before authentication

Next reads the body of every non-GET request the proxy matches into
memory before the route runs. The ceiling was 512 MB so the Apple Health
importer could receive whole archives, which let any anonymous POST to any
API path make the server hold that much.

The ceiling is now 1 MB (proxyClientMaxBodySize). The fifteen routes whose
real bodies are larger are left out of the proxy matcher and read their
own body after authenticating; apiHandler gives them the proxy's refusals
(worker-only, demo mode), security headers and a CSP. safeJson now counts
bytes while it reads and stops at its cap instead of reading everything
first, the CSV and dose-history imports do the same, and a multipart
backup upload is counted while it is read. A test compiles the matcher the way
Next does and checks it skips exactly the listed routes and every route
with a larger body is listed.

Local lab OCR runs its WebAssembly engine in a worker served from
/tesseract/. Those responses, and the /labs and /documents pages that start
the OCR, now carry 'wasm-unsafe-eval' in script-src; no other route does.

src/lib/api-handler.ts

@@ -1,6 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
 import { headers } from "next/headers";
 import type { AccountGrant, User } from "@/generated/prisma/client";
+import {
+  applyBypassRouteHeaders,
+  bypassRouteRefusal,
+  isProxyBypassRoute,
+} from "@/lib/http/proxy-bypass-routes";
 import { prisma } from "@/lib/db";
 import { WideEventBuilder } from "./logging/event-builder";
 import { annotate, eventStorage, getEvent } from "./logging/context";
@@ -200,6 +205,19 @@ export function apiHandler<T extends (...args: any[]) => Promise<Response>>(
       }
     })();
 
+    // A route the proxy matcher leaves out (large uploads, see
+    // `proxy-bypass-routes.ts`) gets the proxy's refusals and headers here.
+    const isBypassRoute = isProxyBypassRoute(url.pathname);
+    if (isBypassRoute) {
+      const refusal = bypassRouteRefusal(
+        safeRequestProp(request, (r) => r.method, "GET"),
+      );
+      if (refusal) {
+        applyBypassRouteHeaders(refusal.headers);
+        return refusal;
+      }
+    }
+
     const evt = new WideEventBuilder("http");
 
     // Propagate x-request-id if present
@@ -330,6 +348,7 @@ export function apiHandler<T extends (...args: any[]) => Promise<Response>>(
         }
         const nr = response as NextResponse;
         nr.headers.set("x-request-id", evt.getRequestId());
+        if (isBypassRoute) applyBypassRouteHeaders(nr.headers);
         // v1.37.0 — echo the record context this response was actually served
         // under, when one was decided. The value comes from the wide event and
         // from nowhere else: the fence stamps it on every call it makes, so