fix(collab): HTTP-layer resource caps — proxy body limit + SSE connection caps

[hblanken]

Stability hardening pass (PR 2 of 5). Bounds two unbounded HTTP resources on the single-replica task.

S3 — preview proxy request-body limit

handlePreviewHttp forwarded request bodies of any size to the in-container dev server. A multi-GB upload (buggy SPA, or hostile POST) would buffer through opencode's heap before the upstream's own 413, swinging the whole task into memory pressure.

Now: reject declared Content-Length > 50 MB at the proxy edge with a 413 before opening the upstream connection. 50 MB is generous — real frontend uploads go straight to S3, not through the dev server.

S4 — SSE connection caps

Each iframe / participant holds a long-lived SSE stream + 20-s heartbeat timer. Two new bounds:

• Per-session concurrency cap (8) — realistic max is 2-3 users × 2-3 tabs; the 9th connection gets a 429 with a "close a tab" hint. Caps the fd + per-stream-closure footprint a reconnect storm or many-tabs client could pile on.
• Idle recycle (2 h) — a stream that has delivered zero real events (keepalives don't count) for 2 h is closed server-side. The SPA auto-reconnects and re-syncs via the connect-time snapshot, so an active session is never interrupted — only quiet/abandoned background tabs get recycled, capping max connection age.

Refactor: cancel() and the idle-recycle path now share one guarded teardown() (clear heartbeat, unregister, set offline, broadcast typing_stop + participant_left) so neither double-runs.

Files

• preview-router.ts — MAX_PREVIEW_BODY_BYTES + 413 guard in handlePreviewHttp
• router.ts — MAX_SSE_PER_SESSION cap + SSE_IDLE_DISCONNECT_MS recycle + shared teardown()

Test plan

• Deploy off this branch
• curl -X POST the preview proxy with a Content-Length: 60000000 header → 413 before the request reaches the dev server
• Normal preview browsing + small POSTs unaffected
• Open 9 tabs on one collab session → 9th gets 429 "too many open connections"; closing a tab frees the slot
• Leave a session idle 2 h → CloudWatch shows SSE idle recycle; the still-open tab silently reconnects (no visible UX change)
• Active session (events flowing) is NOT recycled at the 2 h mark
• Clean tab close still fires participant_left exactly once (no double-teardown)

🤖 Generated with Claude Code