fix: Harden GitHub webhook endpoint against large-body DoS and unauthenticated flood traffic

[jonathanchang31]

Summary

This change fixes issue #196 by protecting /v1/github/webhook with:

• Strict webhook rate limiting
• Request body size limits with 413 Payload Too Large
• Bounded body reading to prevent unbounded memory/CPU work before signature rejection

The endpoint now rejects abusive webhook traffic earlier and more predictably while preserving normal signed webhook behavior.

Related Issue

Fixes: #196

Change Type

• Bug fix
• Security hardening
• API behavior change (error handling for oversized payloads)
• Tests added/updated
• Breaking change

Real Behavior Proof

1) Oversized payload is rejected

Request: 50MB body to /v1/github/webhook
Observed:

• HTTP 413
• Response: {"error":"payload_too_large","maxBytes":1048576}

2) Flood traffic is throttled

Repeated invalid-signature webhook requests observed:

• Initial responses: 401 Unauthorized
• After strict threshold: 429 Too Many Requests

3) Service remains healthy

GET /health returned 200 OK during/after webhook abuse replay.

Security Impact

• Reduces unauthenticated resource-exhaustion risk on public webhook endpoint.
• Prevents large request bodies from being fully processed before rejection.
• Adds deterministic throttling for abusive repeated webhook traffic.

Checklist

• Reproduced issue locally
• Implemented fix in runtime code
• Added/updated automated tests
• Verified behavior with live local worker
• Confirmed health endpoint stability during abuse replay
• No unrelated code changes

[jonathanchang31]

@JSONbored Could you review my PR?

[JSONbored]

@jonathanchang31 This is ready from my side. This is the earlier viable webhook hardening PR, current checks are green, and the merge tree is clean.

A few notes:

• It covers webhook body-size limits plus stricter webhook rate-limit handling.
• Integration and webhook unit tests cover the protected paths.
• Under the duplicate-submission policy, this should be preferred over the later overlapping webhook-body-only PR unless a specific superseding reason is identified.