Recorder response capture buffers whole bodies in memory; abandoned upload sessions are never GCed

[deblasis]

Two housekeeping follow-ups from the #3 review, both low priority.

1. capturingWriter (internal/engine/requestlog/recorder.go) buffers the entire response body in memory before capping the persisted capture at 64 KB. The request side got a proper tee in Engine body limit + req host, photos and graph media planes for migration e2e #3; the response side still duplicates multi-MB media responses (items/{id}/content, media-dl) in memory for the request lifetime. Same tee treatment would fix it.

2. graph-style upload sessions that are never completed leave their session doc and up-{id} partial blob behind forever, and each mid-session chunk rewrites the full accumulated blob (quadratic I/O for many small chunks). Fine for a localhost test tool; worth an expiry sweep or append-capable blob primitive if multi-GB fixtures ever matter.