Fix SEC-05: add body size limit to REST API and max password length

- Wrap r.Body with http.MaxBytesReader (1 MiB) in decodeJSON so all
  REST API endpoints reject oversized JSON payloads
- Add MaxPasswordLen = 128 constant and enforce it in validate.Password()
  to prevent Argon2id DoS via multi-MB passwords
- Add test for oversized JSON body rejection (>1 MiB -> 400)
- Add test for password max length enforcement

Security: decodeJSON now applies the same body size limit the UI layer
already uses, closing the asymmetry. MaxPasswordLen caps Argon2id input
to a reasonable length, preventing CPU-exhaustion attacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/validate/validate.go

@@ -45,11 +45,22 @@ func Username(username string) error {
 // password.
 const MinPasswordLen = 12
 
-// Password returns nil if the plaintext password meets the minimum length
-// requirement, or a descriptive error if not.
+// MaxPasswordLen is the maximum acceptable plaintext password length.
+//
+// Security (SEC-05): Argon2id processes the full password input. Without
+// an upper bound an attacker could submit a multi-megabyte password and
+// force expensive hashing. 128 characters is generous for any real
+// password or passphrase while capping the cost.
+const MaxPasswordLen = 128
+
+// Password returns nil if the plaintext password meets the length
+// requirements, or a descriptive error if not.
 func Password(password string) error {
 	if len(password) < MinPasswordLen {
 		return fmt.Errorf("password must be at least %d characters", MinPasswordLen)
 	}
+	if len(password) > MaxPasswordLen {
+		return fmt.Errorf("password must be at most %d characters", MaxPasswordLen)
+	}
 	return nil
 }

internal/validate/validate_test.go

@@ -32,6 +32,17 @@ func TestPasswordTooShort(t *testing.T) {
 	}
 }
 
+func TestPasswordTooLong(t *testing.T) {
+	// Exactly MaxPasswordLen should be accepted.
+	if err := Password(strings.Repeat("a", MaxPasswordLen)); err != nil {
+		t.Errorf("Password(len=%d) = %v, want nil", MaxPasswordLen, err)
+	}
+	// One over the limit should be rejected.
+	if err := Password(strings.Repeat("a", MaxPasswordLen+1)); err == nil {
+		t.Errorf("Password(len=%d) = nil, want error", MaxPasswordLen+1)
+	}
+}
+
 func TestUsernameValid(t *testing.T) {
 	valid := []string{
 		"alice",