fix(api): accept config envelopes only on requests that carry a body

The envelope middleware buffered and decoded any request carrying its
headers, GETs included, which the router-wide body cap skips and which
read-only tokens may call; its raw read had no cap of its own. Refuse an
envelope on safe methods and read at most the decoded-size limit.

internal/web/middleware/config_envelope.go

@@ -39,11 +39,23 @@ func ConfigEnvelopeMiddleware() gin.HandlerFunc {
 			return
 		}
 
-		raw, err := io.ReadAll(c.Request.Body)
+		// Safe methods carry no config: an envelope there is never legitimate, and read-only
+		// (monitor) callers must not reach the decoder.
+		switch c.Request.Method {
+		case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace:
+			c.AbortWithStatus(http.StatusBadRequest)
+			return
+		}
+
+		raw, err := io.ReadAll(io.LimitReader(c.Request.Body, maxDecodedConfigBytes+1))
 		if err != nil {
 			c.AbortWithStatus(http.StatusBadRequest)
 			return
 		}
+		if len(raw) > maxDecodedConfigBytes {
+			c.AbortWithStatus(http.StatusRequestEntityTooLarge)
+			return
+		}
 		_ = c.Request.Body.Close()
 
 		if enc == wirecodec.EncodingZstd {