Shut down cleanly after refusing an oversized request body #157

Problem

web/server.ts refuses a POST body over its limit with HTTP 413 and returns from the for await (const chunk of req) loop with the rest of the body unread. When the unread remainder is large, the server's shutdown does not finish:

• server.close() never calls back, so close() in startServer never settles past await step(() => closing).
• In production, web/cli.ts then never calls lock.release(), and the later close steps (questions.close, planning close, service.close, which closes the Store) are skipped. The process exits only because nothing else keeps the event loop alive.

A client still sending the body can also get ECONNRESET instead of the 413, so the UI shows a network error instead of "Request too large."

This exists on main (ae9fc3d). Found during the independent review of #146. #146 raises the import limit to 6 MiB + 16 KiB, so through plan import it now takes a much larger file to trigger; any other POST still triggers it just above 16 KiB plus the unread remainder.

Reproduction

A plain Node server with the same loop:

import { createServer } from 'node:http';
const s = createServer(async (req, res) => {
  let size = 0;
  for await (const c of req) { size += c.length; if (size > 16384) { res.writeHead(413); res.end('big'); return; } }
});
await new Promise(r => s.listen(0, '127.0.0.1', r));
const r = await fetch(`http://127.0.0.1:${s.address().port}/`, { method: 'POST', body: 'x'.repeat(+process.argv[2]) });
console.log(r.status);
s.closeIdleConnections(); s.close(e => console.log('server closed', e?.message));

• node repro.mjs 16385: prints 413 and server closed.
• node repro.mjs 2000000: prints 413; server closed never prints.

The same happens with startServer and a POST to /api/action with a 16 KiB + 1 MiB body: 413, then app.close() never settles.

Acceptance

• After a 413, the connection is closed or the request is drained or destroyed explicitly, so server.close() settles.
• The client receives the 413 response for an oversized body, not a reset, where the transport allows it.
• A shutdown regression sends a large overage (well beyond the limit) and asserts that app.close() settles and the Store closes. It fails on the current code.
• The existing bounded-body and shutdown behaviour (readingBody, shutdown's request.destroy) is preserved.