[Adam-Ghanem]

Security upgrade

• Bound POST/PATCH/PUT API payloads to 256 KiB before FastAPI body parsing, even without Content-Length.
• Keep a separate 32 MiB PCAP/PCAPNG upload budget and preserve existing capture error semantics.
• Reject malformed, duplicated, non-decimal, and oversized Content-Length values.
• Guard against a client understating Content-Length by counting actual streamed bytes.
• Upgrade Black from 26.3.1 to 26.10.1, addressing CVE-2026-114134 reported by pip-audit.
• Document reverse proxy request-size/timeout controls and add focused regression coverage.

Validation

• Local targeted FastAPI/Starlette test harness: 10 passed before extra large-header case was added.
• Full GitHub Python CI and Security CI are source-of-truth gates for merging; see PR Checks tab.
• Existing PCAP error contract was restored after the first full-run regression.

Deployment safety

No new outbound connections or changes to authorized network scanning scope; default branch remains untouched until checks pass.