fix(security): AVATAR_PROXY_MAX_BYTES read like a cap and gated only caching

[pitimon]

Summary

Closes #110 item 7. Pre-existing defect, found while closing the round-3 port finding on #109 and deliberately kept out of that PR.

AVATAR_PROXY_MAX_BYTES read like a download cap. It was not one:

const body = Buffer.from(await upstream.arrayBuffer());   // whole body, first
if (body.length <= AVATAR_PROXY_MAX_BYTES) {              // gates CACHING only

The check decided only whether the result entered avatarProxyCache. An oversized response was still read into memory in full and still written to the client, so an allowlisted host serving a very large image/* drove loopback-server memory with no ceiling.

The fix

readCappedAvatarBody() reads at most maxBytes and stops there. Two gates, because either alone is soft:

• content-length is a claim the peer makes, and can be omitted or wrong. Checking it costs nothing and refuses before a byte is transferred.
• A running byte count, because trusting the claim is not an option.

Returning from the for await calls the iterator's return(), which cancels the stream.

Measured, not asserted

A 5120-byte body against a 1024-byte cap now reads 1280 bytes — one chunk past the limit, which is inherent: a chunk cannot be known to overrun until it has arrived. So this is bounded at cap + one chunk, not "stops exactly at the cap".

Behaviour change

An over-cap avatar is now refused with 413 rather than served and merely not cached. 512 KiB is far above any real avatar, and the dashboard falls back to its local icon on a failed image load.

Test plan

• ci:local exit 0 — 889 root tests (+6), 256 dashboard
• An over-cap content-length is refused with the body never touched (the stub records every pull; asserted empty)
• A body exceeding the cap mid-stream stops early — asserted fewer chunks pulled than the body contains
• A lying content-length (declares 10, sends 1536) does not get past the byte count
• A body exactly at the cap is allowed — not off by one
• The no-stream path (HEAD, stubs) is bounded too
• openwiki-facts/source-facts.json regenerated for the new export