fix(gateway): refuse over-limit request bodies with 413

[outofcoffee]

The gateway now answers a completion request body over its limit with a 413 that names the limit and the flag, instead of cutting it off at 1 MiB and failing with a misleading 400.

Summary

• Read the request body with http.MaxBytesReader, so an over-limit body is an error and not a silent truncation.
• Answer an over-limit body 413, naming the limit in bytes and --max-request-bytes.
• Raise the default limit from 1 MiB to 64 MiB, and add --max-request-bytes to spinloop gateway (values below 1 fail at startup).
• Never forward a body that was not read in full: any failed read is refused before routing.
• Document the flag and a short request size section in docs/commands/gateway.md.
• Add the request body limit requirement to the fleet-gateway spec through the gateway-max-request-bytes OpenSpec change, which is not yet archived.

Fixes #240