Pin the request body ceiling instead of inheriting it

The Express shell set a 100kb limit and stopped applying it the moment the
Nest instance took over parsing: bootstrap passed bodyParser:false and
nothing replaced it. The number happened to stay the same, because it is also
the framework default - but it lived nowhere anybody would look for it, and
one NestFactory default away from silently becoming something else.

It goes through Nest's own parser rather than a second express.json(),
because that parser carries the verify hook that keeps req.rawBody, and the
plugin webhook routes need the exact payload bytes to check a provider's
HMAC. Adding a parser in front of it would have taken rawBody away without
failing anything.

MISC-009 and MISC-010 pin it from both sides.

The bodyParser flag on applyGlobalMiddleware goes with it: one caller, which
passed false.

Not moved: cookieParser stays on the raw Express layer rather than becoming a
configure(consumer) middleware. The platform routes - the OAuth consent flow
among them - are registered on that instance before Nest routing exists, so a
Nest-slot cookie parser would simply not run for them. helmet, CORS,
compression, the forced-HTTPS 301 and the res.on('finish') logging stay for
the same reason: they have to see requests Nest never routes.

server/tests/integration/misc.test.ts

@@ -145,3 +145,24 @@ describe('Force HTTPS redirect', () => {
   });
 });
 
+
+describe('Request body ceiling', () => {
+  // The Express shell set '100kb' and stopped when the Nest instance took over
+  // parsing, which left the limit implicit. This pins it, so it cannot drift
+  // back to a framework default without somebody noticing.
+  it('MISC-009 — a body over 100kb is refused with 413', async () => {
+    const res = await request(app)
+      .post('/api/auth/login')
+      .set('Content-Type', 'application/json')
+      .send({ email: 'a@b.c', password: 'x'.repeat(200 * 1024) });
+    expect(res.status).toBe(413);
+  });
+
+  it('MISC-010 — a body under it still reaches the handler', async () => {
+    const res = await request(app)
+      .post('/api/auth/login')
+      .set('Content-Type', 'application/json')
+      .send({ email: 'a@b.c', password: 'x'.repeat(1024) });
+    expect(res.status).not.toBe(413);
+  });
+});