[Security] Configurable JSON body size limit for Express transports

[cloud-nitrostack]

Optional: configurable JSON body size limit for Express transports

Summary: HTTP transports parse JSON bodies with Express's default limits. Exposed servers should allow operators to cap payload size and reduce abuse risk.

Where to change: typescript/packages/core/src/core/transports/streamable-http.ts and typescript/packages/core/src/core/transports/http-server.ts — wherever express.json() is registered.

Background: express.json() is called without a custom limit. Express applies its default maximum body size; for some deployments a stricter or explicit limit is desirable and should be documented.

Acceptance criteria:

• New optional transport option (e.g. jsonBodyLimit) with a sensible default matching current behavior unless you intentionally tighten it.
• Pass { limit: ... } (string or number as Express expects) into express.json({ limit }).
• Document recommended values for production vs dev in README or docs site.

Suggested labels: security, enhancement

---

Source: docs/STARTER_ISSUES_REVIEW.md — edit in-repo first, then sync GitHub issues if needed.