Summary

Closes #1354.

The POST /sdp HTTP handler in WebRTCDirectListener had two unbounded read paths that allowed a remote attacker to consume server memory or hold async tasks indefinitely:

• Unbounded header loop — while True: with only a per-readline 15s timeout. A slow attacker could send one header line every 14s and hold the connection forever.
• Unbounded body allocation — reader.readexactly(content_length) where content_length is attacker-controlled. Content-Length: 2147483647 causes asyncio's StreamReader to grow a ~2 GiB buffer per connection before the timeout fires.

Fix

Three constants + early rejection before any body buffer is allocated:

Non-integer and negative Content-Length values also return 400. The existing _SDP_HTTP_TIMEOUT (15s per readline/readexactly) is unchanged.

Uses Python's for/else idiom: the else clause fires when the header loop exhausts _MAX_HEADER_LINES reads without finding the blank-line terminator. Early return inside try/finally still closes the writer correctly.

Test plan

• Content-Length: 999999999 → 413, RSS high-water mark does not grow by > 1 MiB (body not allocated)
• Content-Length: notanumber → 400
• Content-Length: -1 → 400
• Content-Length: _MAX_SDP_BODY_SIZE (exactly at limit) → 200 (happy path still works)
• _MAX_HEADER_LINES + 1 non-blank header lines → 400
• Single header line > _MAX_HEADER_BYTES → 400
• Valid SDP request → 200, on_offer callback receives correct body
• All 161 WebRTC tests pass (154 existing + 7 new)
• ruff, mypy, pyrefly, pre-commit all clean

Scope note

This harness is documented as a temporary py-to-py scaffold (not interop-compatible with go/js libp2p). The fix raises the bar from "trivially DoSable over LAN" to "needs real attacker model" — appropriate hardening while the STUN-based listener (#1352) is in spike.

Refs #546, #1309, #1352.