fix(http): bound remote media downloads

[furionw]

Why

Dynamo fetches user-supplied remote media through shared HTTP clients, but response size was only known after buffering the complete body. Large or unbounded responses could therefore consume arbitrary memory before callers rejected them. Enforcing an optional limit inside both streaming clients keeps existing uncapped callers unchanged while giving media paths a reliable resource boundary, including across redirects.

What Change

• Add opt-in response byte limits to both HTTP client implementations.
• Reject oversized headers and streaming bodies with a shared typed error.
• Revalidate limits after redirects.

classDiagram
    HttpClient <|-- AiohttpClient
    HttpClient <|-- HttpxClient
    AiohttpClient ..> HttpBodyTooLargeError : rejects oversized streams
    HttpxClient ..> HttpBodyTooLargeError : rejects oversized streams

    note for HttpClient "Defines the optional max-bytes contract"
    note for HttpBodyTooLargeError "Reports one backend-neutral limit failure"

Loading

Test Plan

• Run focused aiohttp and httpx client tests.
• Run pre-commit on all changed files.