Make proxy request-body limit configurable

[Sanskarzz]

Summary

The proxy currently enforces a fixed 8 MiB request-body limit. Users cannot
raise it for legitimate large MCP payloads, such as inline images or documents,
or lower it for stricter environments.

• Make the existing pkg/bodylimit middleware configurable through RunConfig,
  thv run, thv proxy, and MCPServer.spec.maxRequestBodySize.
• Keep omitted and zero values mapped to the secure 8 MiB default, while
  rejecting negative values instead of treating them as unlimited.
• Preserve a configured request-body limit when rebuilding RunConfig during a
  workload upgrade.
• Update generated CLI, OpenAPI, CRD, and operator API documentation.

Fixes #5505

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)
• Build (task build)
• Generated documentation verification (./cmd/help/verify.sh)
• MCPServer operator integration suite (82/82 specs passed)

Generated artifacts were refreshed with task operator-generate,
task operator-manifests, task crdref-gen, and task docs.

The complete operator integration task was also run. Two unrelated OIDC
deletion-race specs failed with UID precondition errors; the focused MCPServer
integration suite passed all 82 specs.

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

The new MCPServer.spec.maxRequestBodySize field is optional and additive.
Existing resources retain the current 8 MiB default.

Changes

File(s)	Change
pkg/runner/{config.go,config_builder.go}	Add the RunConfig field and validating builder option.
pkg/runner/{middleware.go,runner.go}	Apply the configured value through the existing body-limit middleware, reject invalid persisted values early, and keep the limiter outermost.
cmd/thv/app/{run_flags.go,proxy.go}	Add --max-request-body-size to thv run and thv proxy.
cmd/thv-operator/api/v1beta1/mcpserver_types.go	Add the optional spec.maxRequestBodySize field with admission validation.
cmd/thv-operator/controllers/mcpserver_runconfig.go	Translate the MCPServer field into the shared RunConfig.
pkg/workloads/upgrade/applier.go	Preserve the configured limit during workload upgrades.
Tests	Cover builder/runtime validation, CLI and operator wiring, middleware normalization, upgrade preservation, and CRD admission.
Docs and generated artifacts	Document the new inputs and regenerate CLI, OpenAPI, CRD, and operator API output.

Does this introduce a user-facing change?

Yes. Users can configure the maximum inbound MCP proxy request-body size in
bytes through:

• thv run --max-request-body-size
• thv proxy --max-request-body-size
• MCPServer.spec.maxRequestBodySize

Omitting the setting or specifying zero retains the 8 MiB default. Negative
values are rejected.

Implementation plan

Approved implementation plan

1. Add MaxRequestBodySize to the shared RunConfig and expose a validating
   builder option.
2. Pass the value through the two CLI entrypoints and the MCPServer controller.
3. Reuse pkg/bodylimit, resolving zero to its existing 8 MiB default.
4. Normalize the middleware chain to exactly one outermost body-limit entry
   while preserving the order of every other middleware.
5. Preserve the setting when workload upgrades rebuild RunConfig.
6. Add focused unit and operator admission coverage, then regenerate CRDs and
   documentation.

Special notes for reviewers

• Zero deliberately means "use the default," never "unlimited."
• RunConfig.MaxRequestBodySize is authoritative. Existing serialized
  body-limit entries are replaced and duplicates are removed while preserving
  the order of all other middleware.
• The setting applies only to inbound MCP proxy requests. Response bodies, the
  management API's 1 MiB limit, the auth server's 64 KiB limit, and vMCP's fixed
  8 MiB limit are unchanged.
• This reuses the existing pkg/bodylimit middleware; it does not add another
  request-limiting implementation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.70%. Comparing base (e25de16) to head (f9b5153).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6298      +/-   ##
==========================================
- Coverage   77.70%   77.70%   -0.01%     
==========================================
  Files         756      756              
  Lines       72788    72807      +19     
==========================================
+ Hits        56563    56574      +11     
- Misses      16220    16228       +8     
  Partials        5        5              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.