fix(app): add 1MB body size limit to Claude proxy

Track accumulated body size during req.on('data') and abort with 413
if it exceeds 1MB, preventing unbounded memory allocation from
oversized payloads.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/server/claude-proxy.ts

@@ -293,9 +293,20 @@ const server = createServer((req, res) => {
   if (!validateDevAuth(req, res)) return
   if (!checkRateLimit(req, res, true)) return
 
+  const MAX_BODY_SIZE = 1 * 1024 * 1024 // 1 MB
   let body = ''
-  req.on('data', (chunk) => { body += chunk })
+  let aborted = false
+  req.on('data', (chunk) => {
+    body += chunk
+    if (body.length > MAX_BODY_SIZE) {
+      aborted = true
+      res.writeHead(413, { 'Content-Type': 'application/json' })
+      res.end(JSON.stringify({ error: 'Request body too large (max 1MB)' }))
+      req.destroy()
+    }
+  })
   req.on('end', () => {
+    if (aborted) return
     if (req.url === '/v1/openrouter') {
       console.log('[proxy] → OpenRouter proxy')
       streamOpenRouterProxy(body, res)