Testing: Oversized POST body check in examples-web-smoke (#77)

[PurHur]

Problem

PHP_COMPILER_MAX_BODY is enforced in lib/Web/DevServer.php and covered by ServeTest / CgiDriverTest (see #697 ✅), but script/examples-web-smoke.sh does not curl an oversized POST for examples/003-MiniWebApp.

Regressions in body-limit handling can slip through full CI when contributors only run make examples-web-smoke without the PHPUnit serve matrix.

Goal

Add a shell gate (003-only block) that:

1. Starts phpc serve with PHP_COMPILER_MAX_BODY=1024 (or similar)
2. POSTs a body larger than the limit to /index.php/contact
3. Asserts HTTP status is not 200 (expect 413 or connection reset per implementation)

Scope

• Extend script/examples-web-smoke.sh (or script/miniwebapp-gates.sh stage 3) with oversized POST check
• Skip when PHP_COMPILER_SKIP_SERVE_TESTS=1 or loopback bind fails (same as other serve curls)
• Document env in examples/003-MiniWebApp/README.md gate ladder

Acceptance criteria

PHP_COMPILER_MAX_BODY=1024 ./script/examples-web-smoke.sh --miniwebapp-only
# oversized POST step exits 0
./script/ci-local.sh   # full gate still green when serve tests run

Docker:

docker run --rm -v "$(pwd):/compiler" -w /compiler php-compiler:22.04-dev \
  bash -lc 'PHP_COMPILER_MAX_BODY=1024 ./script/examples-web-smoke.sh --miniwebapp-only'

No GitHub Actions required.

Dependencies

• Security: Request body size limits and header sanitization in CGI driver #77 — umbrella for body limits + header sanitization (this issue is the web-smoke slice)
• Security: MiniWebApp contact POST validation and body limits (dev + deploy) #697 ✅ — contact validation (orthogonal)
• CI: Default MINIWEBAPP_WEB_SMOKE_GATE=1 in ci-local.sh (promote gate ladder stage 3) #664 ✅ — default miniwebapp web-smoke in ci-local.sh

Links

• test/real/ServeTest.php (testMiniWebAppContactPostBodyTooLarge)
• test/real/CgiDriverTest.php
• ROADMAP 🗺️ ROADMAP: Self-host + web-capable PHP subset (living) #78 Phase 4 Polish

[PurHur]

Closed via #711 — oversized POST gate in examples-web-smoke.sh.