Engine body limit + req host, photos and graph media planes for migration e2e

[deblasis]

Workstream A of the cloud-migration slice: the stunt-side engine and adapter work that lets the onlin migration e2e run entirely against local sims.

Engine

• Configurable request body limit, honest overflow. New per-service max_body_bytes in stunt.yaml (default stays 1 MiB). The MaxBytesReader error is no longer discarded: overflow returns 413, other read failures 400, and a handler never sees truncated bytes.
• Found while fixing the above: the request-log recorder was pre-reading the body through a 64 KB LimitReader and replacing req.Body with just those bytes, so served requests over 64 KB were already truncated before the 1 MiB cap. The recorder now tees the stream: capture stays capped at 64 KB for the log, the handler reads the full body. This was not in the design (it cited only engine.go:447) but the feature is unshippable without it.
• Host visibility. req["host"] (Go's r.Host) is injected into the Starlark request dict so handlers can mint self-referential URLs. Reference docs (AGENTS.md, stunt llm) updated.

photos-style

• Uploads store the raw request bytes in the blob store keyed by the generated uploadToken (generated ids only, valid blob charset), recording the request Content-Type; batchCreate links the blob to the created media item.
• baseUrl is computed at read time from req["host"] as http://{host}/v1/media-dl/{id}; no host is stored in documents.
• New GET /v1/media-dl/{id} with strict Google suffix semantics: =d/=dv (arriving inside the captured param) serve the original bytes with the recorded content type; a bare baseUrl serves a deterministic derivative payload with different bytes so a client that forgets =d fails byte-comparison loudly. Unknown ids 404.
• New GET /v1/mediaItems/{id}; list and search honor pageSize/pageToken and emit nextPageToken.

microsoft-graph-style (OneDrive write plane, strict)

• Colon addressing via fixed-depth routes with the colon inside the captured segment ({param}: is not routable); handlers strip and require the trailing colon, 400 on malformed addressing.
• Simple upload PUT root:/{name}:/content + items/{parentId}:/{name}:/content: 201 driveItem (id, name, size, parentReference); repeat PUT replaces in place (200, same id); @microsoft.graph.conflictBehavior=rename produces name (1).ext; fail returns 409.
• POST .../createUploadSession (root + folder variants) returns {uploadUrl: http://{host}/v1.0/_upload/{session}, expirationDateTime}.
• PUT /v1.0/_upload/{session}: strict resumable protocol. Content-Range: bytes {start}-{end}/{total} parsed and enforced: start must equal the next expected offset, end >= start, end < total, total consistent across chunks, body length matching the declared range; violations 416, malformed header 400. Mid-session 202 + nextExpectedRanges; final range assembles the blob, creates the driveItem, 201; session deleted so later chunks 404.
• GET items/{id}/content serves stored bytes verbatim; createFolder via POST root/children and items/{id}/children (default fail 409, rename honored); GET root:/{path}:/?select=id path resolution; child listing is per-parent (files docs gained parentId).
• GET /v1.0/me/drive already satisfies a select=quota query with its quota object, verified by test and left as is.

Tests

10 new Go engine-level tests (plus subtests), all booting the real adapters over real HTTP, TDD-first:

• body limit: default oversize 413, just-under-limit byte-exact round-trip, small limit rejects, raised limit accepts 3 MiB
• req["host"] echo matches the listen address
• photos: upload -> batchCreate -> get -> media-dl =d/=dv byte-equality, derivative discrimination, 404s, multi-page list and search pagination
• graph: simple upload + replace + rename + fail + 401/400, folders/resolution/per-parent listing/quota, full chunked session with the 416 matrix and post-completion rejection, folder session variant, 413 with small max_body_bytes

Byte-fidelity fixtures contain all 256 byte values behind a PNG magic prefix, so any future sanitization breaks loudly. Binary planes are covered here because stunt adapter test traces are JSON-only.

just ci green (build, race tests, vet, gofmt, mod tidy, cross-build, lint of all 91 adapters). DISCLAIMER files untouched; stunt adapter lint clean for both adapters.

Deviations from the design

• The recorder-level 64 KB truncation fix (above) was necessary but unanticipated.
• Simple upload default conflict behavior is replace-in-place (200, same id) matching real Graph PUT semantics; the design only named the rename case.
• Session creation returns 200 (real Graph) rather than 201; completed sessions answer 404 (session deleted), which is how the real service behaves for invalidated upload URLs.