p1: cap jq output, log refusals, fail contract without SDK

jq results are bounded (10k items / output cap) and return 400 when
exceeded. 401/403 log caller, host, and reason. make contract exits 1
unless firecrawl-py is present (SIFT_CONTRACT_SKIP_SDK=1 to skip).

internal/api/api_test.go

@@ -217,3 +217,17 @@ func TestFetcherUsesSameGuard(t *testing.T) {
 	_ = key
 	_ = tls.VersionTLS13
 }
+
+func TestJQTooLarge(t *testing.T) {
+	g := &guard.Guard{AllowPrefixes: []netip.Prefix{netip.MustParsePrefix("127.0.0.0/8")}}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`0`))
+	}))
+	defer ts.Close()
+	s, key := setupAPI(t, g)
+	rec := postJSON(t, s, "/v1/fetch", key, map[string]any{"url": ts.URL, "jq": "range(20000)", "mode": "clean"})
+	if rec.Code != 400 || !strings.Contains(rec.Body.String(), "jq output too large") {
+		t.Fatalf("%d %s", rec.Code, rec.Body.String())
+	}
+}