fix(selfhost): cap setup token form parsing

[JSONbored]

Motivation

• The first-run POST /setup path parsed request.formData() for browser-submitted tokens before any size or content-type checks, allowing an unauthenticated client to submit a large or malformed body and cause memory/CPU exhaustion (bootstrap DoS).
• Add a small defensive gate so the server rejects oversized, missing, or unsupported setup-token form uploads before attempting to parse the body.

Description

• Add SETUP_TOKEN_FORM_MAX_BYTES and a setupTokenFormRejection(headers: Headers): Response | undefined helper in src/selfhost/setup-wizard.ts that enforces Content-Length, a 4 KiB max, valid numeric lengths, and only allows application/x-www-form-urlencoded or multipart/form-data.
• Wire the helper into the first-run /setup handler in src/server.ts so the route returns early for rejected requests before calling request.formData().
• Add unit coverage in test/unit/selfhost-setup-wizard.test.ts for oversized, missing/invalid length, unsupported content-type, and accepted content-type cases.

Testing

• Ran git diff --check which produced no errors.
• Ran npx vitest run test/unit/selfhost-setup-wizard.test.ts and the new unit tests passed.
• Ran npm run typecheck which completed successfully.
• Ran npm run test:coverage which encountered unrelated suite timeouts and a coverage remap error (TypeError: jsTokens is not a function) during global coverage generation.
• Ran npm audit --audit-level=moderate which failed due to the registry audit endpoint returning 403 Forbidden.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.41%. Comparing base (4e9a1fd) to head (49e2678).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1287   +/-   ##
=======================================
  Coverage   95.41%   95.41%           
=======================================
  Files         193      193           
  Lines       21006    21018   +12     
  Branches     7609     7613    +4     
=======================================
+ Hits        20043    20055   +12     
  Misses        383      383           
  Partials      580      580           

Files with missing lines	Coverage Δ
src/selfhost/setup-wizard.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	49e2678	Commit Preview URL Branch Preview URL	Jun 26 2026, 08:35 AM

[JSONbored]

Verdict: MERGE · gittensor:bug. Pre-parse DoS cap (411/400/413/415 before formData()) on the unauthenticated /setup POST; all branches covered, green. On-direction (self-host hardening).