Cap request body size and add baseline security headers

Part of a security-hardening pass (see wiki for the full backlog).
decodeJSON had no size limit at all, so every JSON endpoint -- including
the two unauthenticated ones (bootstrap, the Alertmanager webhook) --
would buffer an attacker-supplied body of unbounded size before it was
even validated. decodeJSON now wraps the body in http.MaxBytesReader at
a 1 MiB default; the webhook gets its own 8 MiB cap via decodeJSONLimit,
since a real Alertmanager batch can be bigger than an ordinary API body.

Also adds a securityHeaders middleware, applied globally: nosniff on
every response (previously only the static site got it), and HSTS
(180-day max-age, conservative on purpose) whenever cookieSecure's
signal says the browser is on HTTPS. Checked the chart/gateway config
first -- neither sets HSTS anywhere, so this was a real gap.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

internal/api/security_headers_test.go

@@ -0,0 +1,115 @@
+package api_test
+
+import (
+	"bytes"
+	"net/http"
+	"strings"
+	"testing"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/api"
+)
+
+// ---------------------------------------------------------------------------
+// Security headers
+// ---------------------------------------------------------------------------
+
+func TestSecurityHeaders_NosniffAlwaysSet(t *testing.T) {
+	s := newTS(t) // no PublicURL: the HTTPS signal is off
+	resp := s.req(t, http.MethodGet, "/api/me", nil)
+	defer resp.Body.Close()
+
+	if got := resp.Header.Get("X-Content-Type-Options"); got != "nosniff" {
+		t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
+	}
+	if got := resp.Header.Get("Strict-Transport-Security"); got != "" {
+		t.Errorf("Strict-Transport-Security = %q, want unset without an https PublicURL", got)
+	}
+}
+
+func TestSecurityHeaders_HSTSWhenPublicURLIsHTTPS(t *testing.T) {
+	s := newTS(t, api.NotifyConfig{PublicURL: "https://terdut.example.com"})
+	resp := s.req(t, http.MethodGet, "/api/me", nil)
+	defer resp.Body.Close()
+
+	got := resp.Header.Get("Strict-Transport-Security")
+	if !strings.HasPrefix(got, "max-age=") || !strings.Contains(got, "includeSubDomains") {
+		t.Errorf("Strict-Transport-Security = %q, want a max-age with includeSubDomains", got)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Request body size limits
+// ---------------------------------------------------------------------------
+
+// TestBodySizeLimit_OrdinaryEndpointRejectsOversizedBody confirms an
+// unauthenticated endpoint can't be made to buffer an arbitrarily large body:
+// past maxBodyBytes, decodeJSON fails exactly as it would on any other
+// malformed body, rather than the server reading the whole thing first.
+func TestBodySizeLimit_OrdinaryEndpointRejectsOversizedBody(t *testing.T) {
+	s := newTS(t)
+
+	huge := bytes.Repeat([]byte("a"), 2<<20) // 2 MiB, past the 1 MiB default
+	body := []byte(`{"username":"` + string(huge) + `","password":"x"}`)
+
+	resp, err := http.Post(s.URL+"/api/login", "application/json", bytes.NewReader(body))
+	if err != nil {
+		t.Fatalf("POST /api/login: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d (oversized body treated as invalid)", resp.StatusCode, http.StatusBadRequest)
+	}
+}
+
+// TestBodySizeLimit_WebhookAllowsLargerBodyThanDefault confirms the
+// Alertmanager webhook's separate, larger cap actually takes effect: a body
+// bigger than the ordinary default but within maxWebhookBodyBytes is still
+// accepted, not rejected by the smaller limit every other endpoint gets.
+func TestBodySizeLimit_WebhookAllowsLargerBodyThanDefault(t *testing.T) {
+	s := newTS(t)
+
+	// Padding kept inside one alert's annotation, comfortably past the 1 MiB
+	// default and still well under the webhook's 8 MiB cap.
+	padding := strings.Repeat("a", 3<<20) // 3 MiB
+	payload := `{"version":"4","status":"firing","groupKey":"big-group",` +
+		`"groupLabels":{"alertname":"BigAlert"},"alerts":[{"status":"firing",` +
+		`"labels":{"alertname":"BigAlert"},"annotations":{"note":"` + padding + `"},` +
+		`"startsAt":"2026-05-20T10:00:00Z","endsAt":"0001-01-01T00:00:00Z",` +
+		`"fingerprint":"fp-big"}]}`
+
+	resp, err := http.Post(s.URL+"/api/integrations/"+s.ingestKey+"/alertmanager",
+		"application/json", strings.NewReader(payload))
+	if err != nil {
+		t.Fatalf("POST webhook: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Errorf("status = %d, want %d (body under the webhook's own cap)", resp.StatusCode, http.StatusOK)
+	}
+}
+
+// TestBodySizeLimit_WebhookRejectsPastItsOwnCap confirms the webhook's larger
+// cap is still a cap, not an exemption from one.
+func TestBodySizeLimit_WebhookRejectsPastItsOwnCap(t *testing.T) {
+	s := newTS(t)
+
+	huge := strings.Repeat("a", 9<<20) // 9 MiB, past the 8 MiB webhook cap
+	payload := `{"version":"4","status":"firing","groupKey":"huge-group",` +
+		`"groupLabels":{"alertname":"HugeAlert"},"alerts":[{"status":"firing",` +
+		`"labels":{"alertname":"HugeAlert"},"annotations":{"note":"` + huge + `"},` +
+		`"startsAt":"2026-05-20T10:00:00Z","endsAt":"0001-01-01T00:00:00Z",` +
+		`"fingerprint":"fp-huge"}]}`
+
+	resp, err := http.Post(s.URL+"/api/integrations/"+s.ingestKey+"/alertmanager",
+		"application/json", strings.NewReader(payload))
+	if err != nil {
+		t.Fatalf("POST webhook: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d (body past the webhook's own cap)", resp.StatusCode, http.StatusBadRequest)
+	}
+}