fix(gateway): enforce request body size limits

src/automation/webhooks.test.ts

@@ -220,6 +220,24 @@ describe('WebhookHandler', () => {
     expect(messages).toHaveLength(0);
   });
 
+  it('rejects oversized payloads with 413', async () => {
+    const webhooks = [makeWebhook()];
+    handler = new WebhookHandler(webhooks, mockChannelRegistry as any, 'shared_session', 16);
+
+    const messages: InboundMessage[] = [];
+    handler.onMessage((msg: InboundMessage) => messages.push(msg));
+    await handler.connect();
+
+    const req = mockRequest('x'.repeat(64));
+    const res = mockResponse();
+
+    const result = await handler.handleRequest('test-hook', req, res);
+
+    expect(result).toBe(false);
+    expect(res.statusCode_).toBe(413);
+    expect(messages).toHaveLength(0);
+  });
+
   it('forwards response to output channel on send()', async () => {
     const mockOutputAdapter = {
       send: vi.fn().mockResolvedValue(undefined),