P2: authenticate Node requests before body parsing and enforce a request-body limit

[tuzuminami]

Problem

The Node HTTP server buffers and parses the complete request body in toDriftRequest before the public handler invokes its authentication adapter. An unauthenticated caller can therefore force JSON parsing and memory allocation before receiving the expected 401/403 response. The body size is also not bounded.

This is an availability hardening gap in the otherwise authenticated v1.0.1 server path. It does not invalidate the published v1.0.1 identity/scope protections, but it should be resolved before calling the Node server operationally hardened for hostile public traffic.

Scope

• Authenticate protected /v1 requests from method, path, and headers before reading or parsing their body.
• Keep /healthz and /readyz deliberate unauthenticated, tenant-data-free probe exceptions.
• Enforce a documented maximum request-body size and return a stable 413 envelope.
• Preserve existing 401, 403, 409, 422, and 503 contracts without logging credentials or request bodies.

Acceptance Criteria

• A malformed request with no credentials returns 401 without JSON parsing.
• A request above the configured/default size limit returns 413 without retaining the full body in memory.
• Auth adapter timeout/dependency failures still return 503 with the correlation ID and no credential leakage.
• The public OpenAPI contract, README, and Node-server integration tests cover the new behavior.
• Existing pnpm run check, PostgreSQL CI coverage, package consumer checks, and release evidence continue to pass.

Verification

• Add Node-level HTTP tests for pre-body authentication, 413, probe routes, and normal authorized requests.
• Confirm the release tarball consumer smoke test still imports the server package.