fix: enforce request body size limits across the API

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/webhooks/square.go

@@ -20,10 +20,11 @@ type SquareWebhookEvent struct {
 }
 
 func HandleSquareWebhook(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, 512*1024)
 	body, err := io.ReadAll(r.Body)
 	if err != nil {
 		log.Printf("Failed to read webhook body: %v", err)
-		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		http.Error(w, "request body too large or unreadable", http.StatusRequestEntityTooLarge)
 		return
 	}
 	defer r.Body.Close()