fix(app): add body size limit to dev-chats write endpoint

Track accumulated body length during PUT /api/dev-chats and abort
with 413 if payload exceeds 5MB.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/vite-dev-chats.ts

@@ -5,6 +5,7 @@ import { validateDevAuth } from './server/dev-auth'
 
 const CHATS_DIR = '.dev'
 const CHATS_FILE = 'chats.json'
+const MAX_BODY_SIZE = 5 * 1024 * 1024 // 5MB
 
 function getChatsPath(root: string): string {
   const dir = resolve(root, CHATS_DIR)
@@ -48,8 +49,18 @@ export function devChatsPlugin(): Plugin {
 
         if (req.method === 'PUT') {
           let body = ''
-          req.on('data', (chunk: Buffer) => { body += chunk.toString() })
+          let exceeded = false
+          req.on('data', (chunk: Buffer) => {
+            if (exceeded) return
+            body += chunk.toString()
+            if (body.length > MAX_BODY_SIZE) {
+              exceeded = true
+              res.writeHead(413, { 'Content-Type': 'application/json' })
+              res.end(JSON.stringify({ error: 'Payload too large (max 5MB)' }))
+            }
+          })
           req.on('end', () => {
+            if (exceeded) return
             try {
               JSON.parse(body)
               writeChats(chatsPath, body)