fix(gateway): honor 1 MiB POST /asap body cap

[cursor]

Summary

HIGH: Phase 5 added a 1 MiB dynamic buffer for POST /asap, but every POST/PUT still 413'd when Content-Length exceeded the 64 KiB static cap used by PUT /api/config. Legal ASAP envelopes in (64 KiB, 1 MiB] never reached parse.

Distinct from inbound-server PRs #53 (unwired provider/tools) and #61 (response truncation).

Concrete trigger

A peer posts state.query (or any allowed payload_type) with Content-Length 65537 to 1048576, for example a ~70 KiB JSON pad in payload. asap_http_body_init_from_request allocates the dyn buffer, then http_callback LWS_CALLBACK_HTTP overwrites body_too_large because cl > BODY_BUF_SIZE (65536). http_dispatch_body returns 413 before JSON-RPC parse.

task.request with a moderately large history or document hits the same gate. state.query / task.cancel do not need the provider wiring from #53.

The existing test_asap_body_over_max used Content-Length 1000001, which is still under ASAP_BODY_MAX (1048576). It only 413'd because of this leftover 64 KiB check.

Impact

Inbound ASAP HTTP rejects any envelope above 64 KiB even though the advertised/implemented cap is 1 MiB. Peers cannot deliver large state.query / mcp.tool_call / task.request bodies.

Fix

Skip the static cap when the request is using the /asap dynamic buffer (use_dyn_body). Keep the 64 KiB limit for other POST/PUT routes.

Test plan

• test_exceeds_static_cap — dyn buffer skips 64 KiB; static buffer still 413s
• test_asap_body_over_static_cap_accepted — ~70 KiB state.query returns 200 with result/sessions
• test_asap_body_over_max now uses 1048577 (true 1 MiB + 1)
• GATEWAY=1 test_asap_http_body and test_gateway_http (with -Werror)

  

[adriannoes]

Superseded by #97 (rewrite against current development http_lws.c / test_gateway_http.c).