fix(security): enforce explicit payload size limits and Zod max() con…

[ShantelPeters]

…straints

Problem

• express.json() was called without an explicit limit (defaulting to 100kb)
• No per-route overrides for endpoints with different payload profiles
• All Zod schemas lacked max() constraints on string fields
• Bulk endpoint had no cap on the number of IDs
• No structured 413 error response for oversized payloads

Changes

src/index.ts

• Set global JSON/urlencoded body limit to 10kb
• Per-route override: /api/audit → 100kb (batch audit events)
• Per-route override: /api/admin → 50kb (admin config payloads)
• Added global 4-argument error handler returning clean 413 JSON
• Fixed import ordering (moved mid-file imports to top)
• Fixed error handler placement (before app.listen())

src/routes/subscriptions.ts

• createSubscriptionSchema: name max 100, description max 500, price max 1000000, category max 50, notes max 1000, URLs max 2000
• updateSubscriptionSchema: same limits on all optional fields
• bulkOperationSchema (new): ids array max 50, operation enum, data fields all bounded
• attachGiftCardSchema (new): giftCardHash max 256, provider max 100

src/routes/webhooks.ts

• URL fields: .max(2000) + http/https refine
• events array: .max(6)
• description: max 255

src/routes/merchants.ts

• createMerchantSchema: name max 100, description max 500, category max 50, URLs max 2000, email max 254, country max 2
• updateMerchantSchema: all fields partial

src/routes/team.ts

• inviteSchema: email max 254 + format, role enum with default
• updateRoleSchema: role enum

src/routes/audit.ts

• auditEventSchema: action/resource_type max 100, resource_id max 255, user_id/session_id max 128, status/severity enums
• auditBatchSchema: events array min 1, max 100

tests/payload-limits.test.ts (new)

• 46 tests covering all acceptance criteria:
  • 413 responses for global 10kb, /api/audit 100kb, /api/admin 50kb
  • Zod schema max() enforcement for all route schemas

Closes: payload size limit security issue
Tests: 46 passed, 0 failed (new tests); 0 regressions in existing suite

CLOSES #144