[codex] Reject oversized bill audit requests before settlement

[Dreamstore2046]

Summary

• add BILL_AUDIT_MAX_ITEMS with a default of 500 and document it in .env.example
• reject oversized /bill/audit requests before x402 settlement in both the unified server and standalone bill-audit service
• keep the same max-item guard as a validation fallback inside validateBillAuditRequest
• add bill_audit_oversized_rejections_total for oversized rejection observability
• add focused tests for 501-item rejection, 500-item pass-through, default/env parsing, and validation fallback

Closes #13

Validation

• npm test -- shared/__tests__/bill-audit-max-items.test.ts services/bill-audit-api/__tests__/validation.test.ts shared/__tests__/metrics.test.ts
• npx tsc --noEmit --target ES2022 --module ESNext --moduleResolution bundler --allowImportingTsExtensions --esModuleInterop --allowSyntheticDefaultImports --strict --skipLibCheck --types node,vitest shared/bill-audit.ts shared/metrics.ts shared/__tests__/bill-audit-max-items.test.ts
• git diff --cached --check

[vercel]

@Dreamstore2046 is attempting to deploy a commit to the Harrison Eze's projects Team on Vercel.

A member of the Team first needs to authorize it.