[codex] Limit GitHub webhook request bodies

[jeffreyzeng10]

Summary

• add an early 10 MB Content-Length gate for GitHub webhooks
• read webhook streams with the same byte limit before signature verification
• document the new 413 webhook response and refresh the UI OpenAPI artifact
• cover the new limit/error branches with unit/integration tests

Closes #196

Validation

• npm run typecheck
• npx vitest run test/unit/webhook.test.ts test/integration/api.test.ts
• npm run test:coverage
• npm run ui:openapi:check
• git diff --check

[JSONbored]

@jeffreyzeng10 Thanks for the focused webhook body-limit patch. The implementation is clean, but it now overlaps with an earlier viable first-mover PR in the same webhook hardening area.

I’m going to close this in favor of #197 under our duplicate-submission policy. If there is a specific correctness, security, or scope reason this branch should supersede the first submission, call that out explicitly and we can reconsider.