Harden HTTP request body and upload handling

[Distortions81]

Summary

Harden JSON reads, query parsing, and firmware/frontend uploads against oversized, fragmented, or stalled input.

• Read bounded bodies completely with size_t lengths and a total deadline.
• Strictly parse whole JSON documents and bound statistics queries.
• Reject empty or partition-oversized uploads before writing.
• Enforce total/no-progress upload deadlines and cleanly abort failures.
• Keep upload lengths and progress arithmetic size-safe.

Why

Several handlers read only once or narrowed peer-controlled lengths before checking them. Upload loops also lacked total/stall deadlines. Malformed requests could therefore become partial JSON, unsafe size conversions, or indefinitely occupied handlers.

This keeps the trusted-network model and adds no authentication.

Review follow-up

Incorporates @johnny9's requested production-backed boundary coverage. Small pure size/read/deadline helpers now drive the real HTTP paths and are tested at exact accepted/rejected boundaries.

Stack and related work

Builds cumulatively on #1846 and #1847. Related to #1845, while additionally covering statistics bounds and OTA/AxeOS upload limits and deadlines.

Validation

• ESP-IDF 6.0.2 full firmware and ESP32-S3 test images built
• Exact CI QEMU environment: 83 passed, 0 failed
• AxeOS production build passed with Node.js 22
• git diff --check

[github-actions]

Test Results

  2 files  ±0    2 suites  ±0   1s ⏱️ ±0s
120 tests ±0  120 ✅ ±0  0 💤 ±0  0 ❌ ±0 
122 runs  ±0  122 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 0db611e. ± Comparison against base commit c32b52d.

♻️ This comment has been updated with latest results.

[johnny9]

Reviewed exact head 94c54a4. I did not find a correctness defect in the changed receive/upload implementation. The remaining issue is that the advertised api_rx tests do not exercise the new HTTP body and upload deadline decisions. The production-backed coverage patch passes 81/81 ESP32-S3 QEMU tests and a fresh full ESP-IDF 5.5.3 firmware build.

[johnny9]

Physical Bitaxe 602 smoke test passed on head 02d4154a7e882dffede6e2ac7d074d6ef0288222.

The application-only OTA reported the expected firmware version, the device returned to healthy mining with three stable API samples, zero fault indication, and the configured pool intact. An independent authorized Stratum V1 probe received a fresh mining.notify. The 602 has no separate bridge firmware, so no bridge image was applied.

Full test result and artifacts: https://mining-qa-status.vercel.app/results/55df79e5-1015-423e-a2c1-d9400e605403

Test harness: johnny9/miner-testcode@b3694f6b01617baa8b71ed84c28300baf4cdab61.