fix(gnoweb): In serveEval, use MaxBytesReader to cap the JSON size

[jefft0]

In the spirit of "small PRs against the playground2 branch", this PR fixes this comment from @alexiscolin . We put new constants like maxEvalBodyBytes next to the other constants like maxForkCodeSize.

Following the comment from @moul, we also limit the size of req.PkgPath to 1024 and req.Expression to 64K. Are these good sizes?

[Gno2D2]

🛠 PR Checks Summary

All Automated Checks passed. ✅

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

No automated checks match this pull request.

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission

[davd-gzl]

Verified on ee9f7e0: each cap rejects the oversized input it guards, and an expression at the 64 KiB limit still passes. The suite covers none of these paths.

The sizes you asked about are fine: real pkg paths are dozens of bytes and expressions are short calls, so 1024 and 64 KiB leave plenty of headroom.

Full review: https://github.com/samouraiworld/gno-agent-workspace/blob/main/reviews/pr/5xxx/5897-serveeval-json-size-cap/1-ee9f7e0b0/review_claude-opus-4-8_davd-gzl.md

[davd-gzl]

Missing test: the three new caps have no coverage. Add to TestHandlerPlaygroundEval:

test cases

{
	name:       "oversized body",
	method:     http.MethodPost,
	body:       `{"pkg_path":"r/x","expression":"` + strings.Repeat("a", maxEvalBodyBytes+1) + `"}`,
	wantStatus: http.StatusBadRequest,
	wantError:  "invalid request body",
},
{
	name:       "oversized pkg_path",
	method:     http.MethodPost,
	body:       `{"pkg_path":"` + strings.Repeat("a", maxEvalPkgPathLen+1) + `","expression":"Render(\"\")"}`,
	wantStatus: http.StatusBadRequest,
	wantError:  "too long",
},
{
	name:       "oversized expression",
	method:     http.MethodPost,
	body:       `{"pkg_path":"r/x","expression":"` + strings.Repeat("a", maxEvalExpressionLen+1) + `"}`,
	wantStatus: http.StatusBadRequest,
	wantError:  "too long",
},