Bound request bodies and artifact uploads (Refs #94)

docs/guides/native-hosts.md

@@ -657,10 +657,28 @@ an open Game Files page.
 
 ### Proxy limits and older uploads
 
-The controller and reverse proxy must accept 8 MiB upload requests and folder
-manifests up to 32 MiB. Compose sets `BODY_SIZE_LIMIT=Infinity`; application routes
-still enforce these limits, declared file sizes and checksums. Set a proxy body
-limit of at least 32 MiB (for example `client_max_body_size 32m` in nginx).
+The container and Compose retain `BODY_SIZE_LIMIT=Infinity` for legacy source-host
+imports, which stream whole game files directly to disk and verify manifest sizes
+and checksums. Routes that buffer request bodies enforce limits before parsing:
+ordinary JSON requests (including telemetry) are limited to 1 MiB, authentication
+and user-management JSON to 8 KiB, game-file upload chunks to 8 MiB, and folder
+manifests to 32 MiB. Existing agent endpoints retain their individual limits, up
+to 128 MiB for operation results. Game-file uploads also enforce declared sizes
+and checksums.
+
+Script, plugin and config artifacts are limited to 32 MiB per file, matching the
+host agent. Multipart uploads allow 33 MiB total, including fields and framing;
+beta revisions allow 65 MiB total for multiple replacement files. Both the declared
+request length and actual streamed bytes are checked before multipart parsing.
+Oversized ordinary JSON and artifact uploads receive HTTP 413. GitHub plugin imports use
+the same 32 MiB artifact limit.
+
+Set a proxy body limit of at least 128 MiB (for example
+`client_max_body_size 128m` in nginx) for buffered endpoints. If legacy source-host
+imports are still in use, allow the largest game file on
+`/api/agent/imports/*/files/*`; these transfers do not use the browser's 8 MiB
+chunks. Route limits apply even when connecting directly to the controller.
+
 Existing uploads, host caches and server references remain usable. Previously
 named libraries are grouped under T5 or T6, and the most recently published
 upload for each game becomes its latest files. Their immutable IDs and stored

docs/guides/plugin-releases.md

@@ -40,7 +40,7 @@ GitHub release is imported from its detail page.
 ## Limits
 
 - Public repositories on github.com only; no GitHub credentials are needed.
-- Direct `.dll` release assets up to 64 MB; archives and source-code downloads
+- Direct `.dll` release assets up to 32 MiB; archives and source-code downloads
   are not extracted. Other formats can still use the manual upload workflow.
 - Release tags have the same 80-character limit as manually entered versions.
 - GitHub rate limits, missing releases, download failures and checksum failures