Harden Express request handling

[kasnder]

Summary

• forward every async Express 4 route rejection into centralized error middleware
• return controlled 500 responses for unexpected handler failures while preserving exposed parser status codes
• limit public form parsing to /search with a separate 100kb default
• mount the 25mb JSON/text parsers only on authenticated analyser upload endpoints
• add HTTP regressions for rejected async work, public and nonexistent routes, analyzer authentication, and JSON/text body limits

Root cause

Express 4 does not automatically pass rejected route promises to next, so database failures from routes such as /analysis, /queue, /uploadAnalysis, and /reportAnalysisFailure could become unhandled rejections. Separately, the analyzer-sized JSON, text, and form parsers were mounted globally, allowing any public or nonexistent route to consume the large request-body allowance.

Impact

Async route failures now terminate as controlled HTTP errors instead of risking process-level unhandled rejections. Public requests cannot use the analyzer upload allowance, while existing authenticated analyzer JSON and text uploads retain the configurable BODY_LIMIT behavior. The public search form has an independently configurable PUBLIC_FORM_BODY_LIMIT defaulting to 100kb.

Validation

• npm test — 24 tests passed
• node --check server.js
• node --check routes/index.js
• node --check lib/asyncHandler.js
• node --check test/requestHandling.test.js
• git diff --check

[kasnder]

Review complete. I applied the one robustness fix from the review: the centralized error middleware now accepts either err.status or err.statusCode before validating the 4xx/5xx range (commit 0750b26). npm test passes: 24/24.

The /about and /ping async-to-sync simplification is harmless, though it is slightly outside the PR’s stated focus. No other correctness concerns found.