fix(web): refuse oversized login usernames before recording them

A failed login keeps its username in the in-memory log buffer, the
limiter table and the notifier queue, and the route accepted any body
the global cap allowed. The login route now takes at most 16 KiB and
answers a username over 256 bytes with the generic failure before any
of those see it; the user setters refuse such a name too, so no stored
username can be one the login route turns away.

internal/web/controller/index.go

@@ -47,7 +47,8 @@ func (a *IndexController) initRouter(g *gin.RouterGroup) {
 	g.GET("/sponsors", a.sponsors)
 	g.GET("/sponsors/logo/:name", a.sponsorLogo)
 
-	g.POST("/login", middleware.CSRFMiddleware(getRemoteIp), a.login)
+	// The route carries three short fields; anything longer is refused unread.
+	g.POST("/login", middleware.MaxBodyBytes(16<<10), middleware.CSRFMiddleware(getRemoteIp), a.login)
 	g.POST("/logout", middleware.CSRFMiddleware(getRemoteIp), a.logout)
 	g.POST("/getTwoFactorEnable", middleware.CSRFMiddleware(getRemoteIp), a.getTwoFactorEnable)
 }
@@ -102,6 +103,12 @@ func (a *IndexController) login(c *gin.Context) {
 	}
 
 	remoteIP := getRemoteIp(c)
+	// No stored name is longer; the log buffer, the limiter and the notifiers keep what follows.
+	if len(form.Username) > panel.MaxUsernameLength {
+		logger.Warningf("failed login: IP=%q, reason=%q", remoteIP, "username too long")
+		pureJsonMsg(c, http.StatusOK, false, I18nWeb(c, "pages.login.toasts.wrongUsernameOrPassword"))
+		return
+	}
 	safeUser := template.HTMLEscapeString(form.Username)
 	timeStr := time.Now().Format("2006-01-02 15:04:05")
 	if blockedUntil, ok := defaultLoginLimiter.allow(remoteIP, form.Username); !ok {