fix(api): accept config envelopes only on requests that carry a body

The envelope middleware buffered and decoded any request carrying its
headers, GETs included, which the router-wide body cap skips and which
read-only tokens may call; its raw read had no cap of its own. Refuse an
envelope on safe methods and read at most the decoded-size limit.

internal/web/middleware/config_envelope_test.go

@@ -80,3 +80,34 @@ func TestConfigEnvelope_PlainPassesThrough(t *testing.T) {
 		t.Fatalf("a request with no envelope headers must pass through unchanged: code=%d body=%q", w.Code, w.Body.String())
 	}
 }
+
+// A read-only (monitor) token reaches GET routes only; an envelope never rides on one, so
+// it must not make the panel buffer and decode a body there.
+func TestConfigEnvelope_RefusesAnEnvelopeOnASafeMethod(t *testing.T) {
+	called := false
+	engine := envelopeTestEngine(t, nil)
+	engine.GET("/status", func(c *gin.Context) { called = true })
+	body := bytes.Repeat([]byte("A"), 1<<20)
+	req := httptest.NewRequest(http.MethodGet, "/status", bytes.NewReader(wirecodec.Compress(body)))
+	req.Header.Set("Content-Encoding", wirecodec.EncodingZstd)
+	w := httptest.NewRecorder()
+	engine.ServeHTTP(w, req)
+	if w.Code != http.StatusBadRequest || called {
+		t.Fatalf("GET with an envelope = %d (handler called %v), want 400 before the handler", w.Code, called)
+	}
+}
+
+// The router-wide body cap does not cover every route, so the envelope reads at most
+// what it would accept once decoded.
+func TestConfigEnvelope_CapsTheRawBody(t *testing.T) {
+	called := false
+	engine := envelopeTestEngine(t, func() { called = true })
+	body := bytes.Repeat([]byte("A"), maxDecodedConfigBytes+1)
+	req := httptest.NewRequest(http.MethodPost, "/echo", bytes.NewReader(body))
+	req.Header.Set(wirecodec.HashHeader, wirecodec.Sha256Hex(body))
+	w := httptest.NewRecorder()
+	engine.ServeHTTP(w, req)
+	if w.Code != http.StatusRequestEntityTooLarge || called {
+		t.Fatalf("oversized envelope body = %d (handler called %v), want 413", w.Code, called)
+	}
+}